CVE-2026-55518
Avo, a Ruby on Rails admin panel framework, contains an authorization bypass in its association attach workflow. Authenticated low‑privilege users can send a crafted POST request to attach related records without the UI check, leading to privilege escalation and cross‑tenant data exposure. The flaw is fixed in Avo versions 3.32.1 and 4.0.0.beta.51.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Avo framework users running versions prior to 3.32.1 and 4.0.0.beta.51.
Real-world impact
An attacker with low‑privilege Avo access can bypass UI‑based attach controls and directly associate records, potentially escalating privileges and exposing data across tenants.
Why this severity
CVSS v3.1 base score 9.6 (Critical) due to network‑adjacent attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impacts.
What to do about it
- 01Upgrade Avo to version 3.32.1 or later (stable branch).
- 02If using the 4.0.x beta line, upgrade to version 4.0.0.beta.51 or later.
- ›Restrict network access to the Avo admin interface.
- ›Monitor for unexpected POST requests to /resources/:resource/:id/:related endpoints.
Fix information taken from the NVD description which states the issue is fixed in versions 3.32.1 and 4.0.0.beta.51.
Timeline
- Jul 17, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.