CVE-2026-45573
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
- Affected products
- Decidim, Decidim-Core
- Fix
- Available
- CVSS 3.1
- 6.4 MEDIUM
- Weakness
- CWE-918
- NVD status
- Received
- Published
- 2026-08-06
No indexed exploits for CVE-2026-45573 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-45573 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.