Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

published 2026-04-24 6 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-28836 , GHSA-qc5p-3mg5-9fh8

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.

Patch / fix

fixed in 2 links 1

rubygems avo 3.31.2
avohq avo 3.31.2

github.com/avo-hq/avo/releases/tag/v3.31.2 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 5 mo ago (2026-05-12)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
rubygems	avo	<3.31.2	3.31.2

Affected products

avo-hq avo

Classification

Weakness

CWE-284 Improper Access Control
CWE-639 Authorization Bypass Through User-Controlled Key

References

github.com /avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
exploit, web
github.com /avo-hq/avo/releases/tag/v3.31.2
web
nvd.nist.gov /vuln/detail/CVE-2026-42205
advisory
github.com /avo-hq/avo
package
github.com /rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary