Read the docs
TI-2026-30526 Aliases CVE-2026-42205GHSA-qc5p-3mg5-9fh8

Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Priority HIGH 73CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed avo (avo-hq): 3.31.2avo (RubyGems): 3.31.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
avo-hqavobefore 3.31.23.31.2Patch availableCNA
—avo (RubyGems)before 3.31.23.31.2Patch availableGHSA-qc5p-3mg5-9fh8
  • avo Vendoravo-hq Affected before 3.31.2 Fixed in 3.31.2 Patch available CNA
  • avo (RubyGems) Vendor— Affected before 3.31.2 Fixed in 3.31.2 Patch available GHSA-qc5p-3mg5-9fh8

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:avohq:avo:*:*:*:*:*:*:*:*——avo-hq
  • cpe:2.3:a:avohq:avo:*:*:*:*:*:*:*:* Versions — — ·avo-hq

Remediation

  • Fix · CNA avo (avo-hq) Fixed in 3.31.2
  • Fix · GHSA-qc5p-3mg5-9fh8 avo (RubyGems) Fixed in 3.31.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42205
  2. 2026-10-03 Alias added: GHSA-qc5p-3mg5-9fh8

References

Advisory 1

Other 4

  • TI-2026-40064 Authorization bypass in avo-hq avo CVSS 3.1CRITICAL 9.6
  • TI-2023-16948 Possible unsafe reflection / partial denial of service in avo CVSS 3.1HIGH 8.8
  • TI-2023-16949 Stored XSS (Cross Site Scripting) in html content based fields of avo CVSS 3.1HIGH 7.3
  • TI-2024-14784 Stored cross-site scripting (XSS) in `key_value` field in Avo CVSS 3.1HIGH 7.3
  • TI-2026-38773 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy CVSS 3.1MEDIUM 6.5
  • TI-2024-14985 Cross site scripting in Action messages on Avo CVSS 3.1MEDIUM 6.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences