Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, when VAPID delivery is enabled, the notification subscription flow stores a client-supplied push endpoint without validating that it belongs to an approved push service, and SendPushNotification later passes that endpoint to WebPush.payload_send, allowing an authenticated user to create stored, mostly blind server-side requests to arbitrary reachable HTTPS endpoints. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-06T22:17:07.550Z",
  "pubdate": "2026-08-06T22:17:07.550Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability exists within the Decidim participatory democracy framework when VAPID delivery is enabled.\nThe flaw allows an authenticated user to perform stored, mostly blind server-side HTTP requests to arbitrary reachable HTTPS endpoints.\nThe vulnerability affects Decidim versions prior to 0.30.9, versions from 0.31.0 before 0.31.5, and version 0.32.0.rc1 prior to 0.32.0.rc2.\nExploitation requires authentication within the application and the activation of VAPID delivery features.\nThe risk implication involves malicious actors abusing the push notification mechanism to leverage the underlying server infrastructure as a proxy for initiating unauthorized outbound HTTPS traffic toward internal or external resources.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation within the notification subscription flow.\nSpecifically, when VAPID delivery is enabled, the application ingests and persists a client-supplied push endpoint without verifying whether the target URL belongs to an approved or legitimate push service provider.\nThe vulnerable components involved in the execution path include the notification subscription handling logic and the SendPushNotification function.\nDuring normal operations, SendPushNotification retrieves the stored subscription data and passes the untrusted push endpoint directly to the WebPush.payload_send method.\nBecause the URL is processed without restrictions, an authenticated attacker can supply an arbitrary HTTPS endpoint during the subscription process.\nSubsequent trigger mechanisms invoke the notification dispatch, resulting in the server initiating an outbound HTTPS request to the attacker-controlled or arbitrarily specified URL.\nThe attack flow proceeds as follows: First, the authenticated attacker registers a malicious notification subscription containing a targeted HTTPS URL via the subscription flow. Second, the server stores this unvalidated endpoint in the database. Third, upon notification execution, the SendPushNotification function passes the stored endpoint to WebPush.payload_send, forcing the server to dispatch a web push payload to the arbitrary address.\nAffected versions comprise Decidim prior to 0.30.9, 0.31.0 through 0.31.4, and 0.32.0.rc1.\nAuthentication is required to interact with the notification subscription flow, but standard authenticated user privileges are sufficient to trigger the flaw."
}