← Vulnerability feed

Vulnerability record · CVE-2024-32034 · published 16 September 2024

CVE-2024-32034: Decidim cross-site scripting vulnerability

Decidim · Decidim

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`).

4.8 CVSS 3.1 Medium EPSS 0.37% · top 70.7% CWE-79 · Cross-site scripting
4.8CVSS 3.1 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`).

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/decidim/decidim/commit/23fc8d702a4976727f78617f5e42353d67931645 Patch
https://github.com/decidim/decidim/commit/9d79f09a2d38c87feb28725670d6cc1f55c22072 Patch
https://github.com/decidim/decidim/commit/e494235d559be13dd1f8694345e6f6bba762d1c0 Patch
https://github.com/decidim/decidim/commit/ff755e23814aeb56e9089fc08006a5d3faee47b6 Patch
https://github.com/decidim/decidim/security/advisories/GHSA-rx9f-5ggv-5rh6 Vendor Advisory

Track CVE-2024-32034 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-23891Decidim cross-site scripting vulnerabilityDecidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the …EPSS 0.36%8.2CVE-2025-65017Decidim information exposure vulnerabilityDecidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data expor…EPSS 0.31%7.5CVE-2023-34090Decidim information exposure vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 1.3%7.4CVE-2023-48220Decidim vulnerabilityDecidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites fea…EPSS 0.79%7.1CVE-2023-36465Decidim improper access control vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 0.67%6.5CVE-2026-40869Decidim vulnerabilityDecidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any regist…EPSS 0.31%6.1CVE-2023-34089Decidim cross-site scripting vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 0.74%6.1CVE-2023-32693Decidim cross-site scripting vulnerabilityDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline p…EPSS 0.82%

Source: NIST National Vulnerability Database (record CVE-2024-32034), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.