Read the docs
TI-2020-16101 Aliases CVE-2020-26280

XSS in OpenSlides

Priority MEDIUM 41CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web applications users can enter rich text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Code that will be executed when other users read the respective text. An attacker could utilize this vulnerability be used to manipulate votes of other users, hijack the moderators session or simply disturb the meeting. The vulnerability was introduced with 6eae497abeab234418dfbd9d299e831eff86ed45 on 16.04.2020, which is first included in the 3.2 release. It has been patched in version 3.3 ( in commit f3809fc8a97ee305d721662a75f788f9e9d21938, merged in master on 20.11.2020).

Why it matters now

EPSS 0.01366 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IntevationOpenSlides= 3.2—No fix listedCNA
  • OpenSlides VendorIntevation Affected = 3.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openslides:openslides:3.2:*:*:*:*:*:*:*3.2VulnerableIntevation
  • cpe:2.3:a:openslides:openslides:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Intevation

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26280

References

Patch 2

Advisory 2

Other 1

  • TI-2025-21650 Observable discrepancy in Intevation OpenSlides CVSS 3.1MEDIUM 5.3
  • TI-2025-21649 Path traversal in Intevation OpenSlides CVSS 3.1MEDIUM 6.5
  • TI-2025-21648 Cross-site scripting in Intevation OpenSlides CVSS 3.1MEDIUM 6.1
  • TI-2025-21651 Improper output encoding in Intevation OpenSlides CVSS 3.1MEDIUM 4.1
  • TI-2026-20628 OpenSlides has incorrect access control vulnerability in authentication service CVSS 3.1CRITICAL 9.8
  • TI-2024-15167 OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with… CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences