Read the docs
TI-2024-21125 Aliases CVE-2024-32034GHSA-rx9f-5ggv-5rh6

Cross-site scripting (XSS) in the decidim admin activity log

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. This issue has been addressed in release version 0.27.7, 0.28.2, and newer. Users are advised to upgrade. Users unable to upgrade may redirect the pages /admin and /admin/logs to other admin pages to prevent this access (i.e. `/admin/organization/edit`).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Fix Fixed decidim (decidim): 0.27.7, 0.28.2decidim-admin (RubyGems): 0.27.7, 0.28.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
decidimdecidimbefore 0.27.7; 0.28.0 to before 0.28.20.27.7, 0.28.2Patch availableCNA
—decidim-admin (RubyGems)before 0.27.70.27.7Patch availableGHSA-rx9f-5ggv-5rh6
—decidim-admin (RubyGems)0.28.0 to before 0.28.20.28.2Patch availableGHSA-rx9f-5ggv-5rh6
  • decidim Vendordecidim Affected before 0.27.7; 0.28.0 to before 0.28.2 Fixed in 0.27.7, 0.28.2 Patch available CNA
  • decidim-admin (RubyGems) Vendor— Affected before 0.27.7 Fixed in 0.27.7 Patch available GHSA-rx9f-5ggv-5rh6
  • decidim-admin (RubyGems) Vendor— Affected 0.28.0 to before 0.28.2 Fixed in 0.28.2 Patch available GHSA-rx9f-5ggv-5rh6

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*before 0.27.7Vulnerabledecidim
cpe:2.3:a:decidim:decidim:0.28.0:-:*:*:*:ruby:*:*0.28.0Vulnerabledecidim
cpe:2.3:a:decidim:decidim:0.28.1:*:*:*:*:ruby:*:*0.28.1Vulnerabledecidim
  • cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:* Versions before 0.27.7 Vulnerable ·decidim
  • cpe:2.3:a:decidim:decidim:0.28.0:-:*:*:*:ruby:*:* Versions 0.28.0 Vulnerable ·decidim
  • cpe:2.3:a:decidim:decidim:0.28.1:*:*:*:*:ruby:*:* Versions 0.28.1 Vulnerable ·decidim

Remediation

  • Fix · CNA decidim (decidim) Fixed in 0.27.7, 0.28.2
  • Fix · GHSA-rx9f-5ggv-5rh6 decidim-admin (RubyGems) Fixed in 0.27.7 Advisory →
  • Fix · GHSA-rx9f-5ggv-5rh6 decidim-admin (RubyGems) Fixed in 0.28.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32034
  2. 2026-10-03 Alias added: GHSA-rx9f-5ggv-5rh6

References

Patch 4

Advisory 2

Other 2

  • TI-2025-40203 Decidim's private data exports can lead to data leaks CVSS 4.0HIGH 8.2
  • TI-2023-16936 Decidim vulnerable to sensitive data disclosure CVSS 3.1HIGH 7.5
  • TI-2026-19249 Decidim has a Cross-site scripting (XSS) vulnerability via user name field CVSS 4.0CRITICAL 9.3
  • TI-2023-18306 Decidim has broken access control in templates CVSS 3.1CRITICAL 9.1
  • TI-2023-16935 Decidim Cross-site Scripting vulnerability in the processes filter CVSS 3.1HIGH 8.1
  • TI-2023-15969 Decidim Cross-site Scripting vulnerability in the external link redirections CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences