Executive brief
Avo is a framework used to build administration panels for Ruby on Rails applications. A security flaw was discovered where the system fails to verify user permissions when linking records together via a direct web request, even if the user interface correctly hides the option. This allows a low-privileged user to gain unauthorized access to data or escalate their privileges by manually associating themselves with restricted groups, projects, or administrative roles.
Technical details
A missing authorization check exists in Avo::AssociationsController#create. While the framework correctly validates the 'attach_<association>?' policy for the UI and the 'new' GET action, it fails to enforce the same policy on the 'create' POST endpoint. An authenticated attacker with low privileges can send a crafted POST request to '/resources/:resource/:id/:related' to mutate associations they are not authorized to modify. This can result in privilege escalation or cross-tenant data access if the associations govern access control (e.g., user-to-role or user-to-tenant relationships). The issue is resolved by ensuring 'authorize_attach_action' is called for both 'new' and 'create' actions.
Affected products
- avo-hq avo < 3.32.1
- avo-hq avo >= 4.0.0.beta.1, < 4.0.0.beta.51
Timeline
- 2026-06-13: patched: Fix merged and released in v3.32.1
- 2026-07-17: disclosed: CVE-2026-55518 published