CVE-2026-45573 Details
Description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
A vulnerability exists in Decidim versions prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 prior to 0.32.0.rc2. When VAPID delivery is enabled, the notification subscription process accepts a client-supplied push endpoint without verifying its legitimacy with an approved push service. This oversight allows an authenticated user to manipulate the endpoint, creating stored, mostly blind server-side requests to any reachable HTTPS endpoint from the application server.
Users can update to Decidim versions 0.30.9, 0.31.5, or 0.32.0.rc2, where this vulnerability has been fixed. Alternatively, the VAPID push notifications feature can be disabled by removing the VAPID keys from the server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decidim/decidim/pull/16714 | [email protected] | Issue TrackingVendor |
| https://github.com/decidim/decidim/security/advisories/GHSA-2g9c-vf8h-prxx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Decidim | < 0.30.9 (semver) >= 0.31.0, < 0.31.5 (semver) >= 0.32.0.rc1, < 0.32.0.rc2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |