Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-04T20:02:01 avo: Avo: Unauthorized attachment modification via authorization bypass 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CWE-639

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.

A flaw was found in Avo. An authenticated user could bypass server-side upload authorization and field-level upload policies. This allows them to replace or add attachment content, including binary content, filename, and content-type metadata, on a record. This could lead to unauthorized modification of data, particularly in multi-role deployments where specific per-record or per-field operations are expected to be enforced by policies.

Red Hat Enterprise Linux 10 Fix deferred golang Red Hat Enterprise Linux 8 Fix deferred go-toolset:rhel8/golang Red Hat Enterprise Linux 9 Fix deferred golang Red Hat Hardened Images Not affected gcc Red Hat Hardened Images Not affected gcc13 Red Hat Hardened Images Not affected golang1.25 Red Hat Hardened Images Not affected golang1.26 Red Hat Hardened Images Not affected golang1.27 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Fix deferred openshift-gitops-1/argocd-rhel9 Red Hat OpenStack Platform 18.0 Fix deferred rhoso-operators/openstack-operator-bundle https://www.cve.org/CVERecord?id=CVE-2026-53769 https://nvd.nist.gov/vuln/detail/CVE-2026-53769 https://github.com/avo-hq/avo/commit/de12070dbac0cb6a7e2bea357f9697f99e92554c https://github.com/avo-hq/avo/pull/4520 https://github.com/avo-hq/avo/releases/tag/v3.32.0 https://github.com/avo-hq/avo/security/advisories/GHSA-pqpw-cvm4-8mv9