Decidim core: Decidim: Push subscriptions can be abused for server-side requests (CVE-2026-45573)
Decidim contains a vulnerability in its push-subscription endpoint where an authenticated user can register an attacker-controlled HTTPS URL. When VAPID delivery is enabled, the server sends outbound POST requests to this stored URL, creating a stored, mostly blind server-side request forgery (SSRF) primitive. This allows interaction with arbitrary HTTPS endpoints reachable from the application server, potentially including internal services. The vulnerability affects Decidim versions prior to 0.30.9.
AI Analysis
Technical Summary
The push-subscription endpoint in Decidim improperly stores attacker-controlled delivery URLs without validating that they belong to approved push services. When VAPID delivery is enabled, the stored endpoint is used as the destination for outbound web push notifications via WebPush.payload_send, effectively turning the subscription into an authenticated SSRF vector. This source-to-sink chain enables an attacker to cause the server to send POST requests to arbitrary HTTPS endpoints reachable from the server, potentially disclosing notification metadata to those endpoints. The vulnerability is tracked as CVE-2026-45573 and affects versions before 0.30.9.
Potential Impact
An authenticated user can exploit this vulnerability to cause the Decidim server to send outbound POST requests to arbitrary HTTPS endpoints controlled by the attacker or internal services accessible from the server. This stored SSRF primitive can be used to interact with internal infrastructure or attacker infrastructure, potentially leading to information disclosure via notification metadata included in the encrypted web push request. The impact is limited to confidentiality and integrity of notification metadata, with no direct availability impact reported.
Mitigation Recommendations
A fix is available in Decidim version 0.30.9 and later; upgrading to this version or newer will remediate the vulnerability. As a workaround, disabling the push notifications feature by removing the VAPID keys on the server will prevent exploitation. Users should consult the official Decidim pull request https://github.com/decidim/decidim/pull/16714 for patch details and apply the official fix.
Decidim core: Decidim: Push subscriptions can be abused for server-side requests (CVE-2026-45573)
Description
Decidim contains a vulnerability in its push-subscription endpoint where an authenticated user can register an attacker-controlled HTTPS URL. When VAPID delivery is enabled, the server sends outbound POST requests to this stored URL, creating a stored, mostly blind server-side request forgery (SSRF) primitive. This allows interaction with arbitrary HTTPS endpoints reachable from the application server, potentially including internal services. The vulnerability affects Decidim versions prior to 0.30.9.
CVSS v3.1
Score 6.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The push-subscription endpoint in Decidim improperly stores attacker-controlled delivery URLs without validating that they belong to approved push services. When VAPID delivery is enabled, the stored endpoint is used as the destination for outbound web push notifications via WebPush.payload_send, effectively turning the subscription into an authenticated SSRF vector. This source-to-sink chain enables an attacker to cause the server to send POST requests to arbitrary HTTPS endpoints reachable from the server, potentially disclosing notification metadata to those endpoints. The vulnerability is tracked as CVE-2026-45573 and affects versions before 0.30.9.
Potential Impact
An authenticated user can exploit this vulnerability to cause the Decidim server to send outbound POST requests to arbitrary HTTPS endpoints controlled by the attacker or internal services accessible from the server. This stored SSRF primitive can be used to interact with internal infrastructure or attacker infrastructure, potentially leading to information disclosure via notification metadata included in the encrypted web push request. The impact is limited to confidentiality and integrity of notification metadata, with no direct availability impact reported.
Mitigation Recommendations
A fix is available in Decidim version 0.30.9 and later; upgrading to this version or newer will remediate the vulnerability. As a workaround, disabling the push notifications feature by removing the VAPID keys on the server will prevent exploitation. Users should consult the official Decidim pull request https://github.com/decidim/decidim/pull/16714 for patch details and apply the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2g9c-vf8h-prxx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-45573"]
- Ecosystems
- ["RubyGems"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a55ffbb68715ace432faf70
Added to database: 07/14/2026, 09:22:03 UTC
Last enriched: 07/14/2026, 10:01:22 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.