Avo-hq vulnerabilities
We track 3 vulnerabilities in Avo-hq products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 17, 2026.
Latest Avo-hq vulnerabilities
- 9.6 Critical severity
avo: Authorization Bypass Through User-Controlled Key
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POS
- 8.8 High severity
avo: Improper Access Control
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execut
- 8.8 High severity
avo: Use of Externally-Controlled Input to Select Classes or Code
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote cod