Executive brief
Avo is a framework used to build administration panels for Ruby on Rails applications. A security flaw allows logged-in users to bypass intended restrictions and execute administrative actions they are not authorized to perform. This could lead to unauthorized data changes, such as a regular user granting themselves administrator privileges or deleting sensitive records.
Technical details
A broken access control vulnerability exists in the `ActionsController` of the Avo framework (v3.x) due to insecure action lookup logic in the `action_class` method. The controller identifies the action class to execute by searching through all descendants of `Avo::BaseAction` based on a user-provided `action_id` parameter, without verifying if that action is registered for the specific resource context in the request URL. An authenticated attacker can exploit this by sending a POST request to a legitimate resource endpoint (e.g., posts) while specifying a sensitive action ID (e.g., ToggleAdmin) and a target record ID. This allows for privilege escalation and unauthorized data manipulation across the application. The issue is fixed in version 3.31.2.
Affected products
- avo-hq avo < 3.31.2
Timeline
- 2026-04-20: disclosed: Advisory published by vendor
- 2026-04-24: advisory: GitHub Advisory published
- 2026-05-08: other: NVD published date