CVE-2026-45573

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1

Description When VAPID delivery is enabled, the notification subscription flow fails to validate that the client-supplied push endpoint belongs to an approved push service. An authenticated user can provide an arbitrary HTTPS URL via the endpoint parameter in the POST /notifications subscriptions endpoint. This value is stored in user.notification settings["subscriptions"] and subsequently passed to the WebPush.payload send() function. This creates a stored, mostly blind Server-Side Request Forgery (SSRF) primitive, allowing the server to send outbound POST requests to arbitrary reachable HTTPS endpoints, including internal services. Additionally, notification metadata may be disclosed to the supplied endpoint through the encrypted web push request path.

Recommendations Update to version 0.30.9. Update to version 0.31.5. Update to version 0.32.0.rc2. As a temporary workaround, disable the push notifications feature by removing the VAPID keys from the server.