CVE-2023-32693

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7.

• CWE-79

• https://github.com/decidim/decidim/releases/tag/v0.26.7Release Notes
• https://github.com/decidim/decidim/releases/tag/v0.27.3Release Notes
• https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535rThird Party Advisory
• https://github.com/decidim/decidim/releases/tag/v0.26.7Release Notes
• https://github.com/decidim/decidim/releases/tag/v0.27.3Release Notes
• https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535rThird Party Advisory

Published

Jul 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32688parse-server-push-adapter is the official Push Notification …7.5
• CVE-2023-32689Parse Server is an open source backend that can be deployed …6.5
• CVE-2023-3269A vulnerability exists in the memory management subsystem of…7.8
• CVE-2023-32690libspdm is a sample implementation that follows the DMTF SPD…7.5
• CVE-2023-32691gost (GO Simple Tunnel) is a simple tunnel written in golang…5.9
• CVE-2023-32692CodeIgniter is a PHP full-stack web framework. This vulnerab…9.8
• CVE-2023-32694Saleor Core is a composable, headless commerce API. Saleor's…5.4
• CVE-2023-32695socket.io parser is a socket.io encoder and decoder written …7.5
• CVE-2023-32696CKAN is an open-source data management system for powering d…8.8
• CVE-2023-32697SQLite JDBC is a library for accessing and creating SQLite d…9.8
• CVE-2023-32698nFPM is an alternative to fpm. The file permissions on the c…7.1
• CVE-2023-32699MeterSphere is an open source continuous testing platform. V…6.5