CVE-2026-45573: Decidim: Push subscriptions can be abused for server-side requests

July 13, 2026

The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send path becomes an outbound-request sink when VAPID delivery is enabled. The practical result is an authenticated, stored, mostly blind SSRF primitive to arbitrary HTTPS endpoints reachable from the app server.

References

github.com/advisories/GHSA-2g9c-vf8h-prxx
github.com/decidim/decidim/pull/16714
github.com/decidim/decidim/security/advisories/GHSA-2g9c-vf8h-prxx
nvd.nist.gov/vuln/detail/CVE-2026-45573

Code Behaviors & Features

Detect and mitigate CVE-2026-45573 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →