CVE-2026-55518 Details
Description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.
A critical vulnerability exists in the Avo framework for Ruby on Rails, specifically in versions prior to 3.32.1 and 4.0.0.beta.51. The issue arises from a missing authorization check in the association attach workflow. While the UI and the 'GET /resources/:resource/:id/:related/new' path properly verify authorization, the 'POST /resources/:resource/:id/:related' endpoint does not. This oversight allows authenticated low-privileged users to bypass UI controls and directly attach related records to parent records by sending a crafted POST request. Such actions can lead to privilege escalation and cross-tenant data exposure, particularly in applications where associations involve authorization-bearing relationships.
Users can update to Avo versions 3.32.1 or 4.0.0.beta.51, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/avo-hq/avo/security/advisories/GHSA-8fq9-273g-6mrg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/avo-hq/avo/commit/995928e586fd1788dd496bd51c4dbe4a79cb2b9c | [email protected] | Source CodeVendor |
| https://github.com/avo-hq/avo/pull/4568 | [email protected] | Issue TrackingVendor |
| https://github.com/avo-hq/avo/releases/tag/v3.32.1 | [email protected] | AdvisoryRelease NotesVendor |
| https://github.com/avo-hq/avo/security/advisories/GHSA-8fq9-273g-6mrg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Avo | <= 3.32.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |