Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-45573: Decidim: Push subscriptions can be exploited for unauthorized requests

CVE-2026-45573 · published 3 months ago

Summary

A vulnerability in Decidim's push subscription system allows attackers to make unauthorized requests to external websites. This could lead to data breaches or other security issues if not addressed. Decidim users should update to the latest version to fix this issue.

What to do

Update josep jaume rey peroy decidim-core to version 0.30.9.
Update josep jaume rey peroy decidim-core to version 0.31.5.
Update josep jaume rey peroy decidim-core to version 0.32.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
rubygems	josep jaume rey peroy	decidim-core	< 0.30.9 >= 0.31.0.rc1, < 0.31.5 >= 0.32.0.rc1, < 0.32.0 Fix: upgrade to 0.30.9
–	decidim	decidim	< 0.30.9

Original advisory text

Decidim: Push subscriptions can be abused for server-side requests

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45573... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-45573 Vendor Advisory
https://github.com/advisories/GHSA-2g9c-vf8h-prxx
https://github.com/decidim/decidim/security/advisories/GHSA-2g9c-vf8h-prxx Vendor Advisory
https://github.com/decidim/decidim/pull/16714 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published6 Aug 2026

Updated4 Nov 2026

First seen13 Jul 2026

Sources

GHSA-2g9c-vf8h-prxx · GHSA

CVE-2026-45573 · NVD

CVE-2026-45573 · MITRE

CVE-2026-45573 · OSV

Track software like this

Free during beta