avo vulnerabilities

3 known vulnerabilities in avo from Avo-hq. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  avo: Authorization Bypass Through User-Controlled Key

  CVE-2026-55518Jul 17, 2026Avo-hq

  Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POS

• 8.8 High severity

  avo: Improper Access Control

  CVE-2026-42205May 8, 2026Avo-hq

  Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execut

• 8.8 High severity

  avo: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2023-34102Jun 5, 2023Avo-hqEPSS 1.61%

  Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote cod