CVE-2026-45573 in Decidim
Summary
by MITRE • 08/07/2026
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described affects Decidim, a participatory democracy framework that enables citizen engagement through digital platforms. This security flaw exists in specific version ranges where the framework's push notification system fails to properly validate client-supplied endpoints during the subscription process. The issue stems from insufficient input validation mechanisms that allow malicious actors to manipulate the notification delivery flow.
The technical implementation of this vulnerability involves the VAPID (Voluntary Application Server Identification) push notification protocol which is designed to provide authentication for push services. When enabled, the system stores user-provided push endpoints without verifying their legitimacy against approved push service providers. This validation gap creates a path where an authenticated user can submit any HTTPS endpoint URL to be used for notifications. The system then passes this unvalidated endpoint directly to WebPush.payload_send method, which executes server-side requests to the specified target.
The operational impact of this vulnerability is significant as it enables what security researchers would classify as a server-side request forgery (SSRF) or more specifically a stored blind SSRF attack. An authenticated user can leverage this flaw to create persistent requests that reach arbitrary HTTPS endpoints within the network's reach, potentially allowing them to probe internal systems, exfiltrate data from internal services, or perform other malicious activities. This represents a critical escalation path since it allows an attacker with valid credentials to bypass normal network security controls and initiate communications with internal resources.
The vulnerability aligns with CWE-918, which covers server-side request forgery, and could be categorized under ATT&CK technique T1071.004 for application layer protocol usage. The issue affects multiple version streams simultaneously, indicating a systemic problem in the framework's input validation logic that was not properly addressed across the release cycle. The fix implemented in versions 0.30.9, 0.31.5, and 0.32.0.rc2 demonstrates the importance of proper endpoint validation in push notification systems and highlights the necessity of maintaining consistent security controls across all framework components.
Organizations using Decidim should immediately upgrade to the patched versions to prevent exploitation. Additional mitigations include implementing network-level restrictions on outbound HTTPS traffic, monitoring for unusual patterns in push notification delivery, and ensuring that authentication controls remain robust. The vulnerability underscores the critical importance of validating all user-supplied inputs, particularly in systems that handle external communications or network requests, as even authenticated users can create security risks when proper validation is absent.