CVE-2026-55518

Received Received - Intake

Authorization Bypass in Avo Admin Panel Framework

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-55518

Affected Vendors & Products

Vendor	Product	Version / Range
avohq	avo	to 3.32.1 (inc)
avohq	avo	to 4.0.0.beta.51 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Avo framework for Ruby on Rails admin panels. It allows low-privileged authenticated users to bypass authorization checks and attach related records to parent records via a crafted POST request. The issue exists because the UI and GET endpoint check permissions, but the POST endpoint for writing associations does not enforce the same checks.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to paths like /resources/:resource/:id/:related. Check if authorization checks are missing for association attachments. Review Avo framework logs for unauthorized association modifications.

Impact Analysis

An attacker with low privileges could escalate their access by attaching unauthorized records to sensitive parent records. This could lead to privilege escalation or exposure of sensitive data across tenants if associations represent authorization-bearing relationships.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. Unauthorized privilege escalation or cross-tenant data exposure may result in regulatory penalties.

Mitigation Strategies

Upgrade Avo to version 3.32.1 or 4.0.0.beta.51 or later. Implement strict access controls for POST /resources/:resource/:id/:related endpoints. Audit user permissions and disable low-privileged users until patched.

Hi! I’m here to help you understand CVE-2026-55518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70