CVE-2026-55518
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Authorization bypass in Avo framework (Ruby on Rails) allowing low-privileged users to attach related records directly, leading to privilege escalation and cross-tenant data exposure. Fixed in versions 3.32.1 and 4.0.0.beta.51.
Risk Assessment
An attacker can escalate privileges and access data from other tenants, breaking data isolation and confidentiality.
Recommendation
Update Avo to version 3.32.1 or 4.0.0.beta.51 (or later).
Original NVD description (English source)
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.