A stored XSS vulnerability exists in GeoNode's rich text editor in versions >=3.2.1 <4.2.3. Although cookies are set securely, the attacker can exploit the XSS to steal the victim's CSRF token and issue authenticated requests to change the victim's email address, enabling full account takeover. The vulnerability bypasses CORS policy protections, allowing malicious scripts to perform unauthorized actions within the victim's session context.

Successful exploitation allows an attacker to perform a full account takeover by changing the victim's email address through CSRF token theft via stored XSS. This compromises the confidentiality and integrity of the victim's account. There is no indication of availability impact. The vulnerability affects user accounts and session security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when interacting with untrusted content in the rich text editor. Consider disabling or restricting rich text input if feasible. Monitor official GeoNode channels for updates and apply any official fixes once released.