A flaw in Decidim’s push notification subscription flow allows an authenticated user to store a client‑supplied push endpoint without verifying that it belongs to an approved push service. During notification delivery the stored endpoint is passed to the WebPush library, resulting in blind server‑side requests to the arbitrary HTTPS URL supplied by the attacker. This permits the server to initiate outbound HTTPS connections to any reachable endpoint, without the attacker having to directly access the server.

Decidim, the participatory‑democracy framework, is affected. Versions prior to 0.30.9, those in the 0.31.x series before 0.31.5, and the 0.32.0.rc1 version before 0.32.0.rc2 can be impacted when VAPID delivery is enabled.

The CVSS score of 6.4 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a currently low to medium exploitation likelihood. Because the attack requires an authenticated user, only compromised accounts can exploit it, but once authenticated the attacker can direct the server to any reachable HTTPS endpoint. The likely attack vector is an authenticated user submitting a malicious push subscription.