What is the CVSS score of CVE-2026-42205?

CVE-2026-42205 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Avo are affected by CVE-2026-42205?

The Avo Rails administration panel (versions 3.x before 3.31.2) enables privilege escalation, allowing ordinary application users to seize administrative permissions and freely modify any business…. A patch is available.

How to fix or mitigate CVE-2026-42205?

Within 24 hours, inventory your infrastructure to identify all deployments of Avo 3.x for Ruby on Rails and document current versions. Within 7 days, upgrade all affected instances to Avo 3.31.2 or later and deploy changes to production. Within 30 days, audit access logs and data modification records from the past 90 days to identify any unauthorized administrative actions or data changes performed by low-privilege accounts, and reset credentials for any potentially compromised administrative users.

Avo CVE-2026-42205

EUVD-2026-28836 HIGH

Improper Access Control (CWE-284)

2026-05-08 GitHub_M

GHSA-qc5p-3mg5-9fh8

Authentication Bypass Privilege Escalation Avo

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable admin endpoint, low complexity, requires a low-privilege authenticated account (PR:L), and arbitrary action execution yields total confidentiality, integrity and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:40 vuln.today

Analysis Generated

Jul 23, 2026 - 22:40 vuln.today

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 21:26 nvd

HIGH 8.8

DescriptionGitHub Advisory

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.

AnalysisAI

Privilege escalation in the Avo admin framework for Ruby on Rails (all 3.x versions prior to 3.31.2) lets any authenticated low-privilege user invoke arbitrary Action classes against arbitrary resources, because the ActionsController resolves actions by name across all Avo::BaseAction descendants without checking resource registration. An attacker can trigger sensitive operations such as ToggleAdmin on records they should not control, resulting in unauthorized data manipulation and role escalation across the entire application. A proof-of-concept exists in the GitHub advisory (SSVC exploitation: poc); this is no public exploit identified as actively exploited, and EPSS is low at 0.04%.

Technical ContextAI

Avo is a Ruby gem (cpe:2.3:a:avo-hq:avo) that auto-generates CRUD admin panels for Rails apps, where 'Actions' are server-side operation classes (subclasses of Avo::BaseAction) that operators register per-resource to control which bulk/record operations are exposed. The root cause is CWE-284 (Improper Access Control): the action_class method in app/controllers/avo/actions_controller.rb resolves the target action by iterating Avo::BaseAction.descendants and matching params[:action_id] to the class name, with no validation that the action is registered for the resource named in the request URL. Because Ruby's descendants reflection enumerates every loaded action class globally, the controller trusts an attacker-supplied class name and executes it, decoupling the intended resource-to-action authorization mapping from the code path that actually runs the action.

RemediationAI

Vendor-released patch: upgrade the avo gem to 3.31.2 or later (bundle update avo, then confirm Gemfile.lock pins >= 3.31.2), per the advisory at https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 and release notes at https://github.com/avo-hq/avo/releases/tag/v3.31.2. Until the upgrade can be deployed, reduce exposure by restricting who holds Avo admin-panel credentials and tightening authorization: revoke or downgrade low-trust accounts, and if feasible network-restrict the admin mount path (e.g. /admin) to trusted operators via IP allowlist or VPN, accepting that this blocks legitimate remote operators. As a code-level stopgap you can override or wrap the ActionsController action lookup to verify that the requested action_id is actually among the actions registered for the target resource before executing it, though custom patches carry maintenance and correctness risk versus simply upgrading to 3.31.2.