Executive brief
DotVVM is a web framework for building ASP.NET applications. A critical flaw exists where the security filter intended to restrict access to authorized users fails to perform any checks. This allows any user to bypass intended security restrictions and access protected parts of an application without needing to log in or provide credentials.
Technical details
A vulnerability classified as Missing Authorization (CWE-862) exists in DotVVM's AuthorizeActionFilter class. The component fails to implement any actual authorization logic, effectively acting as a no-op filter. An unauthenticated attacker can reach protected endpoints over the network without any specific exploit complexity, as the filter does not validate the user's identity or permissions. This results in a complete bypass of intended access controls. The issue is resolved in versions 4.2.11, 4.3.15, and 5.0.0-preview09. A workaround is to use the AuthorizeAttribute instead.
Affected products
- riganti DotVVM < 4.2.11, > 4.3.0-preview01-final, < 4.3.15, >= 5.0.0-preview01-final, < 5.0.0-preview09-final
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory