{"id":"CVE-2026-53769","title":"Avo is a framework to create admin panels for Ruby on Rails apps","summary":"Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-862","CWE-863","CWE-639"],"vendor":"avo-hq","product":"avo","affected":["avo >= 2.28.0, < 3.32.0"],"patched":["avo 3.32.0"],"published":"2026-09-04","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:17:03.117","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53769","references":[{"url":"https://github.com/avo-hq/avo/commit/de12070dbac0cb6a7e2bea357f9697f99e92554c","label":"security-advisories@github.com"},{"url":"https://github.com/avo-hq/avo/pull/4520","label":"security-advisories@github.com"},{"url":"https://github.com/avo-hq/avo/releases/tag/v3.32.0","label":"security-advisories@github.com"},{"url":"https://github.com/avo-hq/avo/security/advisories/GHSA-pqpw-cvm4-8mv9","label":"security-advisories@github.com"},{"url":"https://github.com/avo-hq/avo/security/advisories/GHSA-pqpw-cvm4-8mv9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53769.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-53769"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528883"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53769"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53769"},{"url":"https://github.com/advisories/GHSA-pqpw-cvm4-8mv9"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","ghsa","rubygems"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:57:19.419562Z"},"epss":0.00254,"epssPercentile":0.1714,"aliases":["GHSA-pqpw-cvm4-8mv9"],"ecosystem":"rubygems","ingestedAt":"2026-07-09T21:52:34.710Z","slug":"CVE-2026-53769","body":"## Overview\n\nAvo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53769)\n\nAffected packages:\n\n- `avo >= 2.28.0, < 3.32.0`\n\nPatched in:\n\n- `avo 3.32.0`\n\nSource: https://github.com/advisories/GHSA-pqpw-cvm4-8mv9\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift GitOps, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift GitOps, … · updated 2026-09-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53769.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201755,"id":"CVE-2026-53769","ts":1789399674902,"field":"exploit_available","old":"false","new":"true"},{"seq":200485,"id":"CVE-2026-53769","ts":1789397339978,"field":"exploit_available","old":"true","new":"false"},{"seq":198402,"id":"CVE-2026-53769","ts":1789391897829,"field":"exploit_available","old":"false","new":"true"},{"seq":196196,"id":"CVE-2026-53769","ts":1789383547097,"field":"exploit_available","old":"true","new":"false"},{"seq":195125,"id":"CVE-2026-53769","ts":1789380424616,"field":"exploit_available","old":"false","new":"true"},{"seq":193912,"id":"CVE-2026-53769","ts":1789378442017,"field":"exploit_available","old":"true","new":"false"},{"seq":192699,"id":"CVE-2026-53769","ts":1789376374712,"field":"exploit_available","old":"false","new":"true"},{"seq":191486,"id":"CVE-2026-53769","ts":1789373352056,"field":"exploit_available","old":"true","new":"false"},{"seq":190271,"id":"CVE-2026-53769","ts":1789369259340,"field":"exploit_available","old":"false","new":"true"},{"seq":189058,"id":"CVE-2026-53769","ts":1789368226254,"field":"exploit_available","old":"true","new":"false"},{"seq":187841,"id":"CVE-2026-53769","ts":1789365117192,"field":"exploit_available","old":"false","new":"true"},{"seq":186628,"id":"CVE-2026-53769","ts":1789363219837,"field":"exploit_available","old":"true","new":"false"},{"seq":185414,"id":"CVE-2026-53769","ts":1789361064419,"field":"exploit_available","old":"false","new":"true"},{"seq":184201,"id":"CVE-2026-53769","ts":1789358098290,"field":"exploit_available","old":"true","new":"false"},{"seq":182452,"id":"CVE-2026-53769","ts":1789354192144,"field":"exploit_available","old":"false","new":"true"},{"seq":181245,"id":"CVE-2026-53769","ts":1789353080568,"field":"exploit_available","old":"true","new":"false"},{"seq":180038,"id":"CVE-2026-53769","ts":1789350135868,"field":"exploit_available","old":"false","new":"true"},{"seq":178831,"id":"CVE-2026-53769","ts":1789348044661,"field":"exploit_available","old":"true","new":"false"},{"seq":177624,"id":"CVE-2026-53769","ts":1789346253133,"field":"exploit_available","old":"false","new":"true"},{"seq":176417,"id":"CVE-2026-53769","ts":1789342967668,"field":"exploit_available","old":"true","new":"false"},{"seq":174534,"id":"CVE-2026-53769","ts":1789334731106,"field":"exploit_available","old":"false","new":"true"},{"seq":173329,"id":"CVE-2026-53769","ts":1789333443461,"field":"exploit_available","old":"true","new":"false"},{"seq":172143,"id":"CVE-2026-53769","ts":1789330971243,"field":"exploit_available","old":"false","new":"true"},{"seq":170957,"id":"CVE-2026-53769","ts":1789328555940,"field":"exploit_available","old":"true","new":"false"},{"seq":169752,"id":"CVE-2026-53769","ts":1789327034470,"field":"exploit_available","old":"false","new":"true"},{"seq":168547,"id":"CVE-2026-53769","ts":1789323617478,"field":"exploit_available","old":"true","new":"false"},{"seq":167342,"id":"CVE-2026-53769","ts":1789319467773,"field":"exploit_available","old":"false","new":"true"},{"seq":166137,"id":"CVE-2026-53769","ts":1789318497183,"field":"exploit_available","old":"true","new":"false"},{"seq":164932,"id":"CVE-2026-53769","ts":1789315671890,"field":"exploit_available","old":"false","new":"true"},{"seq":163727,"id":"CVE-2026-53769","ts":1789313422827,"field":"exploit_available","old":"true","new":"false"},{"seq":162522,"id":"CVE-2026-53769","ts":1789311795238,"field":"exploit_available","old":"false","new":"true"},{"seq":161317,"id":"CVE-2026-53769","ts":1789308477764,"field":"exploit_available","old":"true","new":"false"},{"seq":160822,"id":"CVE-2026-53769","ts":1789304408203,"field":"exploit_available","old":"false","new":"true"},{"seq":160369,"id":"CVE-2026-53769","ts":1789303940011,"field":"exploit_available","old":"true","new":"false"},{"seq":159430,"id":"CVE-2026-53769","ts":1789300366443,"field":"exploit_available","old":"false","new":"true"},{"seq":158660,"id":"CVE-2026-53769","ts":1789299437555,"field":"exploit_available","old":"true","new":"false"},{"seq":157624,"id":"CVE-2026-53769","ts":1789296558613,"field":"exploit_available","old":"false","new":"true"},{"seq":156419,"id":"CVE-2026-53769","ts":1789294536064,"field":"exploit_available","old":"true","new":"false"},{"seq":155214,"id":"CVE-2026-53769","ts":1789292758239,"field":"exploit_available","old":"false","new":"true"},{"seq":154009,"id":"CVE-2026-53769","ts":1789289536720,"field":"exploit_available","old":"true","new":"false"},{"seq":152659,"id":"CVE-2026-53769","ts":1789281446280,"field":"exploit_available","old":"false","new":"true"},{"seq":152299,"id":"CVE-2026-53769","ts":1789281042563,"field":"exploit_available","old":"true","new":"false"},{"seq":151260,"id":"CVE-2026-53769","ts":1789277508271,"field":"exploit_available","old":"false","new":"true"},{"seq":150221,"id":"CVE-2026-53769","ts":1789276022825,"field":"exploit_available","old":"true","new":"false"},{"seq":149188,"id":"CVE-2026-53769","ts":1789273672904,"field":"exploit_available","old":"false","new":"true"},{"seq":148155,"id":"CVE-2026-53769","ts":1789271063646,"field":"exploit_available","old":"true","new":"false"},{"seq":146190,"id":"CVE-2026-53769","ts":1789269260601,"field":"exploit_available","old":"false","new":"true"},{"seq":145090,"id":"CVE-2026-53769","ts":1789266239635,"field":"exploit_available","old":"true","new":"false"},{"seq":143994,"id":"CVE-2026-53769","ts":1789262541836,"field":"exploit_available","old":"false","new":"true"},{"seq":142803,"id":"CVE-2026-53769","ts":1789261311109,"field":"exploit_available","old":"true","new":"false"}]}