https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 23:57:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-317421 EUVD-2026-317421 https://cve.radiocsirt.org/vuln/euvd-2026-317421 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42205 <p>Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.</p> <p>Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42205 https://cve.radiocsirt.org/vuln/ghsa-qc5p-3mg5-9fh8 <p><strong>Affected:</strong> RubyGems: avo</p> <p>### Summary</p> <p>A critical Broken Access Control vulnerability was identified in the `ActionsController` of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of `Avo::BaseAction`) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application.</p> <p>### Details</p> <p>The vulnerability exists in the `action_class` method within `app/controllers/avo/actions_controller.rb`.</p> <p>#### Vulnerable Code</p> <p>```ruby def action_class # It searches through ALL descendants of BaseAction without resource validation Avo::BaseAction.descendants.find do |action| action.to_s == params[:action_id] end end ```</p> <p>The controller identifies the action class to execute solely based on the `params[:action_id]` by searching through all `BaseAction` descendants. It fails to verify whether the requested action is actually permitted or registered for the resource context specified in the request URL (e.g., `/admin/resources/posts/actions`).</p> <p>Consequently, an attacker can invoke sensitive actions (e.g., `Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint (e.g., `Post`), bypassing the intended resource-action mapping.</p> <p>### Impact</p> <p>This flaw results in significant security risks:</p> <p>- **Privilege Escalation:** An authenticated user with low privileges can execute administrative actions (like toggling admin ro…</p> <p><strong>Affected:</strong> RubyGems: avo</p> <p>### Summary</p> <p>A critical Broken Access Control vulnerability was identified in the `ActionsController` of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of `Avo::BaseAction`) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application.</p> <p>### Details</p> <p>The vulnerability exists in the `action_class` method within `app/controllers/avo/actions_controller.rb`.</p> <p>#### Vulnerable Code</p> <p>```ruby def action_class # It searches through ALL descendants of BaseAction without resource validation Avo::BaseAction.descendants.find do |action| action.to_s == params[:action_id] end end ```</p> <p>The controller identifies the action class to execute solely based on the `params[:action_id]` by searching through all `BaseAction` descendants. It fails to verify whether the requested action is actually permitted or registered for the resource context specified in the request URL (e.g., `/admin/resources/posts/actions`).</p> <p>Consequently, an attacker can invoke sensitive actions (e.g., `Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint (e.g., `Post`), bypassing the intended resource-action mapping.</p> <p>### Impact</p> <p>This flaw results in significant security risks:</p> <p>- **Privilege Escalation:** An authenticated user with low privileges can execute administrative actions (like toggling admin ro…</p> https://cve.radiocsirt.org/vuln/ghsa-qc5p-3mg5-9fh8