CVE-2026-45573
- Source
- https://cve.org/CVERecord?id=CVE-2026-45573
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45573.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45573
- Aliases
- Published
- 2026-08-06T20:14:07.078Z
- Modified
- 2026-08-08T11:36:39.458290540Z
- Severity
-
- 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Decidim: Push subscriptions can be abused for server-side requests
- Details
-
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
- Database specific
{ "cwe_ids": [ "CWE-918" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45573.json" }- References