Server-side Request Forgery (SSRF) Affecting decidim-core package, versions <0.30.9>=0.31.0.rc1, <0.31.5>=0.32.0.rc1, <0.32.0.rc2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUBY-DECIDIMCORE-17970858
- published14 Jul 2026
- disclosed13 Jul 2026
- creditUnknown
Introduced: 13 Jul 2026
NewCVE-2026-45573 (opens in a new tab)How to fix?
Upgrade decidim-core to version 0.30.9, 0.31.5, 0.32.0.rc2 or higher.
Overview
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the notification subscription process when VAPID delivery is enabled. An attacker can cause the server to send outbound requests to arbitrary HTTPS endpoints by supplying a crafted endpoint URL during the subscription process. Notification metadata may be disclosed to the attacker-controlled endpoint through the encrypted web push request path.
Workaround
This vulnerability can be mitigated by disabling the push notifications feature by removing the VAPID keys from the server.