Executive brief
DotVVM is an open-source web framework for building .NET applications with client-side and server-side components. The AuthorizeActionFilter, a component responsible for protecting commands and views from unauthorized access, fails to perform any authorization checks in versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final. This allows attackers to access protected features without authentication or authorization, potentially exposing sensitive application functionality and data.
Technical details
The AuthorizeActionFilter class in DotVVM implements ICommandActionFilter, IViewModelActionFilter, and IPresenterActionFilter interfaces but fails to enforce authorization. The vulnerable implementations of OnCommandExecutingAsync, OnViewModelCreatedAsync, and OnPresenterExecutingAsync return completed tasks without invoking the underlying authorization checks, effectively bypassing all access control. The vulnerability affects network-reachable web applications and requires no authentication or special bypass techniques—any unauthenticated request can trigger protected commands or access protected view models. The issue is resolved in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final through fixes that properly invoke authorization validation. The AuthorizeAttribute class correctly implements the same interfaces and can serve as a temporary workaround.
Affected products
- DotVVM DotVVM before 4.2.11, before 4.3.15, and before 5.0.0-preview09-final
Timeline
- 2026-09-14: disclosed
- 2026-06-18: patched: Fixes released in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final