PT-2026-37177 · Avo · Avo

Xillunight · CVE-2026-42205 · Published 2026-04-24 · Updated 2026-05-09

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avo versions prior to 3.31.2

Description A broken access control issue exists in the ActionsController due to insecure action lookup logic in the action class() function. An authenticated user can execute any Action class that descends from Avo::BaseAction on any resource, regardless of whether the action is registered for that specific resource. This occurs because the controller identifies the action class solely based on the action id parameter without verifying if the action is permitted for the resource context. This can lead to privilege escalation and unauthorized data manipulation, such as executing administrative actions through unrelated resource endpoints.

Recommendations Update to version 3.31.2.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2026-42205

GHSA-QC5P-3MG5-9FH8

Affected Products

Avo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42205.json · Exploit
• 🔥 https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml · Exploit
• https://osv.dev/vulnerability/CVE-2026-42205 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qc5p-3mg5-9fh8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42205 · Security Note
• https://github.com/avo-hq/avo/releases/tag/v3.31.2 · Note
• https://github.com/avo-hq/avo · Note
• https://twitter.com/CVEnew/status/2053131437692633463 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052988510747939261 · Twitter Post