PT-2026-37177 · Avo · Avo

Xillunight · Published 2026-04-24 · Updated 2026-05-09 · CVE-2026-42205

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avo versions prior to 3.31.2

Description A broken access control issue exists in the ActionsController due to insecure action lookup logic in the action class() function. An authenticated user can execute any Action class that descends from Avo::BaseAction on any resource, regardless of whether the action is registered for that specific resource. This occurs because the controller identifies the action class solely based on the action id parameter without verifying if the action is permitted for the resource context. This can lead to privilege escalation and unauthorized data manipulation, such as executing administrative actions through unrelated resource endpoints.

Recommendations Update to version 3.31.2.

Exploit

Fix

IDOR

Improper Access Control

Weakness Enumeration

CWE-639

CWE-284

Related Identifiers

CVE-2026-42205

GHSA-QC5P-3MG5-9FH8

Affected Products

Avo

References · 8

• 🔥 https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42205 · Security Note
• https://osv.dev/vulnerability/GHSA-qc5p-3mg5-9fh8 · Vendor Advisory
• https://github.com/avo-hq/avo/releases/tag/v3.31.2 · Note
• https://github.com/avo-hq/avo · Note
• https://twitter.com/VulmonFeeds/status/2052988510747939261 · Twitter Post
• https://twitter.com/CVEnew/status/2053131437692633463 · Twitter Post