Avo CVE-2025-53769: Missing Upload Authorization Bypasses Field-Level Policies

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Missing upload authorization on the direct attachment upload endpoint, bypassing field-level upload policies Vulnerability Type: Missing Server-Side Authorization Severity: Medium CVE ID: CVE-2025-53769 CVSS v3.1 Score: 6.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Core Issue: Avo exposes a direct attachment upload endpoint ( ) that does not validate the association for the requested attachment or perform any upload authorization checks when creating an . Authenticated Avo users can replace or add attachment content (including binary data, filename, and content-type metadata) even if the target record is denied by field-level policies (e.g., ). Scope of Impact Affected Versions: (fixed version pending confirmation by maintainers) Primary Impact Scenarios: In multi-tenant Avo deployments, non-admin or restricted operators can replace/add attachments that field-level policies would have otherwise denied. Specific Impacts: - Authenticated users can replace or add attachment content (binary, filename, content-type). - Uploads succeed even when the target record is denied by field-level policies (e.g., ). - The endpoint does not invoke , resulting in the bypass of policy checks. - In admin-facing deployments, non-admin operators can replace or add attachments even when field-level policies would have denied the action. Fix Recommendations Recommended Fix Directions: 1. Validate the requested before storing any Blob. 2. Perform upload authorization prior to . 3. Derive the policy method from the validated . 4. Apply the equivalent authorization decision (allow/deny). 5. Return a response compatible with standard HTTP semantics. Default Behavior: defaults to at ; the fix takes effect without requiring a custom authorization client. Mitigations: - Applications can add a custom authorization client to explicitly enforce upload policies. - Until a fix is available, applications can reduce exposure by ensuring that only fully trusted administrators can access Avo routes. - Applications requiring immediate mitigation can fall back to a default-deny behavior (denying all uploads). POC Code `` :admin: true` (required to pass the coarse-grained route guards in the dummy app) Authorization Check authorize_user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user, ->(user,

Goal Reached Thanks to every supporter — we hit 100%!

Avo CVE-2025-53769: Missing Upload Authorization Bypasses Field-Level Policies

More from this source