EUVD-2026-28836
GHSA-qc5p-3mg5-9fh8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Avo admin panel with low privileges
-
DeliveryIdentify sensitive action class and target record ID
-
ExploitPOST action_id to unrelated resource /actions endpoint
-
ExecutionActionsController resolves class via unvalidated descendants lookup
-
PersistExecute privileged action (e.g. ToggleAdmin) on target
-
ImpactEscalate privileges and manipulate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Avo admin-panel session (CVSS PR:L) - the attacker needs a valid, even low-privilege, Avo user account with access to at least one resource's actions endpoint. Concretely, the attacker must know or guess the fully-qualified class name of a sensitive registered action (e.g. Avo::Actions::ToggleAdmin) and a target record ID, then POST it to any resource's /actions endpoint. Limiting factors: it only affects apps using Avo 3.x below 3.31.2 that define at least one sensitive BaseAction, exploitation is not automatable (SSVC Automatable: no) because valid credentials plus knowledge of action class names and target IDs are needed, and admin panels are frequently network-restricted, all of which narrow real-world reach despite the network attack vector. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) is internally consistent with the description: network-reachable, low complexity, requires only a low-privilege authenticated session, no user interaction, and high impact to confidentiality, integrity and availability - matching SSVC 'Technical Impact: total'. Countervailing signals temper urgency: EPSS is very low (0.04%, 12th percentile), SSVC marks exploitation as only 'poc' (not active) and Automatable 'no' (because the attacker must first obtain a valid admin-panel account and identify target record IDs and action class names), and the affected component is an admin panel that is typically not exposed to anonymous internet users. This is a genuine, high-severity authorization flaw that should be patched promptly wherever Avo admin accounts are granted to semi-trusted or lower-tier users, but the low EPSS and required authentication make it a targeted insider/low-priv-escalation risk rather than a mass-exploitation internet threat. |
| Exploit ScenarioDerived | A low-privilege user who has been given a limited Avo admin account logs in, then sends a crafted POST to a resource endpoint that does not register the sensitive action (e.g. POST /admin/resources/posts/actions with action_id=Avo::Actions::ToggleAdmin and fields[avo_resource_ids]=1). The server executes ToggleAdmin against User ID 1, escalating privileges; a proof-of-concept demonstrating exactly this flow is published in the GitHub advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Privilege escalation in the Avo admin framework for Ruby on Rails (all 3.x versions prior to 3.31.2) lets any authenticated low-privilege user invoke arbitrary Action classes against arbitrary resources, because the ActionsController resolves actions by name across all Avo::BaseAction descendants without checking resource registration. An attacker can trigger sensitive operations such as ToggleAdmin on records they should not control, resulting in unauthorized data manipulation and role escalation across the entire application. A proof-of-concept exists in the GitHub advisory (SSVC exploitation: poc); this is no public exploit identified as actively exploited, and EPSS is low at 0.04%.
RemediationAI
Vendor-released patch: upgrade the avo gem to 3.31.2 or later (bundle update avo, then confirm Gemfile.lock pins >= 3.31.2), per the advisory at https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8 and release notes at https://github.com/avo-hq/avo/releases/tag/v3.31.2. Until the upgrade can be deployed, reduce exposure by restricting who holds Avo admin-panel credentials and tightening authorization: revoke or downgrade low-trust accounts, and if feasible network-restrict the admin mount path (e.g. /admin) to trusted operators via IP allowlist or VPN, accepting that this blocks legitimate remote operators. As a code-level stopgap you can override or wrap the ActionsController action lookup to verify that the requested action_id is actually among the actions registered for the target resource before executing it, though custom patches carry maintenance and correctness risk versus simply upgrading to 3.31.2.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Avo is a Ruby gem (cpe:2.3:a:avo-hq:avo) that auto-generates CRUD admin panels for Rails apps, where 'Actions' are server-side operation classes (subclasses of Avo::BaseAction) that operators register per-resource to control which bulk/record operations are exposed. The root cause is CWE-284 (Improper Access Control): the action_class method in app/controllers/avo/actions_controller.rb resolves the target action by iterating Avo::BaseAction.descendants and matching params[:action_id] to the class name, with no validation that the action is registered for the resource named in the request URL. Because Ruby's descendants reflection enumerates every loaded action class globally, the controller trusts an attacker-supplied class name and executes it, decoupling the intended resource-to-action authorization mapping from the code path that actually runs the action.
Know when Avo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin endpoint, low complexity, requires a low-privilege authenticated account (PR:L), and arbitrary action execution yields total confidentiality, integrity and availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.
Executive ViewAI
The Avo Rails administration panel (versions 3.x before 3.31.2) enables privilege escalation, allowing ordinary application users to seize administrative permissions and freely modify any business data in the system. For any organization relying on Avo for user access management, this vulnerability exposes sensitive operations, customer records, and account control to unauthorized alteration. Remediation requires immediate patching to version 3.31.2.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Avo is an open source ruby on rails admin panel creation framework. Rated high severity (CVSS 8.8), this vulnerability i
Avo is a framework to create admin panels for Ruby on Rails apps. Rated medium severity (CVSS 5.4), this vulnerability i
Avo is a framework to create admin panels for Ruby on Rails apps. Rated medium severity (CVSS 5.4), this vulnerability i
Avo is an open source ruby on rails admin panel creation framework. Rated medium severity (CVSS 5.4), this vulnerability
Exploit-DB