CVE-2026-45573

Received Received - Intake

Server-Side Request Forgery in Decidim

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-45573

Affected Vendors & Products

Vendor	Product	Version / Range
decidim	decidim	to 0.30.9 (inc)
decidim	decidim	From 0.31.0 (inc) to 0.31.5 (exc)
decidim	decidim	From 0.32.0.rc1 (inc) to 0.32.0.rc2 (exc)
decidim	decidim	to 0.32.0.rc2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Decidim participatory democracy framework. When VAPID delivery is enabled, the system fails to validate that a push endpoint belongs to an approved service before storing it. This allows an authenticated user to create stored server-side requests to arbitrary HTTPS endpoints.

Impact Analysis

An authenticated attacker could exploit this to send requests to internal or external HTTPS endpoints, potentially leading to data exfiltration, server-side request forgery, or other unintended interactions with systems reachable from the server.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential breaches of personal or sensitive data.

Mitigation Strategies

Upgrade Decidim to version 0.30.9, 0.31.5, or 0.32.0.rc2 or later to address the vulnerability in the notification subscription flow.

Hi! I’m here to help you understand CVE-2026-45573. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70