Is CVE-2026-57578 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57578 being exploited in the wild.

How severe is CVE-2026-57578?

Informational severity, with a CVSS score of 7.5, published 14 September 2026.

Which products and versions are affected?

DotVVM DotVVM before 4.2.11, before 4.3.15, and before 5.0.0-preview09-final.

Is there a fix for CVE-2026-57578?

A patch was published on 2026-06-18: Fixes released in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57578 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57578?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57578: DotVVM AuthorizeActionFilter authorization bypass

CVE-2026-57578 · Severity: info · CVSS 7.5 · Published 2026-09-14

DotVVM is an open-source web framework for building .NET applications with client-side and server-side components. The AuthorizeActionFilter, a component responsible for protecting commands and views from unauthorized access, fails to perform any authorization checks in versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final. This allows attackers to access protected features without authentication or authorization, potentially exposing sensitive application functionality and data.

Quick answers

Is CVE-2026-57578 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57578 being exploited in the wild.
How severe is CVE-2026-57578?: Informational severity, with a CVSS score of 7.5, published 14 September 2026.
Which products and versions are affected?: DotVVM DotVVM before 4.2.11, before 4.3.15, and before 5.0.0-preview09-final.
Is there a fix for CVE-2026-57578?: A patch was published on 2026-06-18: Fixes released in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57578 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57578?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The AuthorizeActionFilter class in DotVVM implements ICommandActionFilter, IViewModelActionFilter, and IPresenterActionFilter interfaces but fails to enforce authorization. The vulnerable implementations of OnCommandExecutingAsync, OnViewModelCreatedAsync, and OnPresenterExecutingAsync return completed tasks without invoking the underlying authorization checks, effectively bypassing all access control. The vulnerability affects network-reachable web applications and requires no authentication or special bypass techniques—any unauthenticated request can trigger protected commands or access protected view models. The issue is resolved in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final through fixes that properly invoke authorization validation. The AuthorizeAttribute class correctly implements the same interfaces and can serve as a temporary workaround.

Affected products

DotVVM DotVVM before 4.2.11, before 4.3.15, and before 5.0.0-preview09-final

Timeline

2026-09-14: disclosed
2026-06-18: patched: Fixes released in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.