CVE-2026-45573

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45573

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45573.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45573

Aliases

GHSA-2g9c-vf8h-prxx

Published

2026-08-06T20:14:07Z

Modified

2026-10-28T02:30:48Z

Severity

6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Decidim: Push subscriptions can be abused for server-side requests

Details

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45573.json"
}

References

Affected packages

Git / github.com/decidim/decidim

Affected ranges

Type

GIT

Repo

https://github.com/decidim/decidim

Events

Introduced

Fixed

899e5a43fa02b4709d95b63de7294289ea87cc41

Introduced

c3bc51462268ff734342aac28f456ac77837d4c8

Fixed

03d80881ac459127f0e11999c8a733cf78e78736

Introduced

1f92fc97fd7186639617ce1b2ca53b6cbecb1eb8

Fixed

f891077eb17bccc05afb1ba65c5c3073e811703c

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.30.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0.31.0.rc1"
                },
                {
                    "fixed": "0.31.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0.32.0.rc1"
                },
                {
                    "fixed": "0.32.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        }
    ]
}

Affected versions

v0.*

v0.0.1

v0.0.1.alpha

v0.0.1.alpha1

v0.0.1.alpha2

v0.0.1.alpha3

v0.0.1.alpha4

v0.0.1.alpha5

v0.0.1.alpha6

v0.0.1.alpha7

v0.0.1.alpha8

v0.0.1.alpha9

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.8.1

v0.1.0

v0.2.0

v0.20.0

v0.3.0

v0.30.0

v0.30.0.rc1

v0.30.0.rc2

v0.30.0.rc3

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.30.5

v0.30.6

v0.30.7

v0.30.8

v0.31.0

v0.31.0.rc1

v0.31.0.rc2

v0.31.1

v0.31.2

v0.31.3

v0.31.4

v0.32.0.rc1

v0.32.0.rc2

v0.32.0.rc3

v0.4.0

v0.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45573.json"