Executive brief
Avo is an admin panel framework for Ruby on Rails applications. A vulnerability in its file upload system allows authenticated users to bypass security policies and upload or replace files on records they shouldn't be able to modify. This could allow a restricted user to overwrite important documents or images, potentially leading to data integrity issues or unauthorized content changes within the application.
Technical details
A missing authorization check exists in `Avo::AttachmentsController#create`. The endpoint processes file uploads and attaches them to records via ActiveStorage without invoking the expected Pundit-style policy methods like `upload_{FIELD_ID}?` or `update?`. An authenticated attacker can directly POST to the `/avo_api/resources/:resource_name/:id/attachments/` endpoint to modify attachments on a resolved record, even if their role is explicitly restricted by application policies. This bypasses both UI-level controls and server-side policy enforcement. The issue is fixed in version 3.32.0.
Affected products
- avo-hq avo >= 2.28.0, < 3.32.0
Timeline
- 2026-05-29: disclosed: Vulnerability confirmed via source inspection and PoC.
- 2026-06-02: advisory: GitHub Advisory published.
- 2026-07-09: patched: Advisory updated with final details.