Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-57578— DotVVM: Missing authorization in AuthorizeActionFilter

Quick assessment

Affected
riganti dotvvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DotVVM 是一个用于 Web 应用的开源 MVVM 框架。在 4.2.11、4.3.15 和 5.0.0-preview09-final 之前的版本中， 未执行任何授权检查，因为其显式实现的 、 和 方法直接返回已完成的任务（completed tasks），而未调用相应的授权检查逻辑。因此，依赖此过滤器的应用程序可能会在没有任何特殊绕过技术的情况下，将受保护的命令、视图模型或 Presenter 暴露给未授权的请求。 正确实现了相同的接口，可作为临时解决方案使用。该问题已在版本 4.2.11、4.3.15 和

CVSS 9.2 · Critical

Affected Version Matrix 3

VendorProduct Version RangeStatus
riganti dotvvm < 4.2.11 affected
>= 4.3.0, < 4.3.15 affected
>= 5.0.0-preview01, < 5.0.0-preview09-final affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57578

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DotVVM: Missing authorization in AuthorizeActionFilter
Source: CVE Program / CVE List V5
Vulnerability Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
riganti dotvvm < 4.2.11 -

II. Public POCs for CVE-2026-57578

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57578

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57578 (2)

Vendor Advisories for CVE-2026-57578 (1)

Vendor Pages for CVE-2026-57578 (1)

Same Patch Batch · riganti · 2026-09-14 · 3 CVEs total

CVE-2026-57577 8.2 HIGH DotVVM: ReDOS in routing
CVE-2026-57581 5.3 MEDIUM DotVVM: Unrestricted file upload

IV. Related Vulnerabilities

Same product: dotvvm
Same vendor: riganti
Same weakness: CWE-862

V. Comments for CVE-2026-57578

No comments yet

Leave a comment