CVE-2026-53769— Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Quick assessment
Affected
avo-hq avo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Avo 是一个用于创建 Ruby on Rails 应用管理后台的框架。在 2.28.0 到 3.32.0 之前的版本中，Avo 的直接附件上传端点缺少服务端上传授权检查，并且绕过了文档中说明的字段级上传策略方法（如 ）。任何能够访问 Avo 附件上传端点的已认证 Avo 用户，即使 和 策略均拒绝该操作，也可以替换或添加附件内容，包括二进制内容、文件名和内容类型元数据，作用于已解析的记录。此问题主要影响采用多角色 Avo Pro/Advanced 部署模式的场景，其中非管理员或受限操作员用户可以访问 Avo，并且
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1079 T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53769
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Source: CVE Program / CVE List V5
Vulnerability Description
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-53769
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53769
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53769 (2)
Vendor Advisories for CVE-2026-53769 (1)
Vendor Pages for CVE-2026-53769 (1)
-
🔗 Release Release v3.32.0 · avo-hq/avo · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: avo
-
CVE-2026-55518
Avo: Missing Authorization in Avo Association Attach Endpoin -
CVE-2026-42205
Avo: Broken Access Control: Unauthorized Execution of Arbitr -
CVE-2026-33209
Avo has a XSS vulnerability on `return_to` param -
CVE-2024-22411
Cross site scripting in Action messages on Avo -
CVE-2024-22191
Stored cross-site scripting (XSS) in `key_value` field in Av
Same vendor: avo-hq
-
CVE-2026-55518
Avo: Missing Authorization in Avo Association Attach Endpoin -
CVE-2026-42205
Avo: Broken Access Control: Unauthorized Execution of Arbitr -
CVE-2026-33209
Avo has a XSS vulnerability on `return_to` param -
CVE-2024-22411
Cross site scripting in Action messages on Avo -
CVE-2024-22191
Stored cross-site scripting (XSS) in `key_value` field in Av
Same weakness: CWE-862
-
CVE-2026-86091
ntopng before 6.7.260717 Missing Authorization on the Host P -
CVE-2026-86090
ntopng before 6.7.260717 Missing Authorization on the Notifi -
CVE-2026-82684
Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization -
CVE-2026-63464
Nebula-mesh allows non-admin operators to disable webhook SS -
CVE-2026-53602
nebula-mesh - Host revocation is not durable: blocked/offboa
V. Comments for CVE-2026-53769
No comments yet