{"id":"GHSA-c8qj-jx8j-fg2w","title":"DotVVM: Missing authorization in AuthorizeActionFilter","summary":"DotVVM: Missing authorization in AuthorizeActionFilter","severity":"critical","cwe":["CWE-862"],"vendor":"DotVVM","product":"DotVVM","affected":["DotVVM < 4.2.11","DotVVM > 4.3.0-preview01-final, < 4.3.15","DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final"],"patched":["DotVVM 4.2.11","DotVVM 4.3.15","DotVVM 5.0.0-preview09-final"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-c8qj-jx8j-fg2w","references":[{"url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w"},{"url":"https://github.com/advisories/GHSA-c8qj-jx8j-fg2w"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T15:52:21.101Z","ecosystem":"nuget","slug":"GHSA-c8qj-jx8j-fg2w","body":"## Overview\n\n### Impact\n\nAll users of the `AuthorizeActionFilter` class are affected. The `AuthorizeActionFilter` simply does nothing, no “hacking” is needed to bypass the filter.\n\n### Patches\n\nDotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this.\n\n### Workarounds\n\nAs a workaround, you can use the `AuthorizeAttribute` instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.\n\n## Affected packages\n\n- `DotVVM < 4.2.11`\n- `DotVVM > 4.3.0-preview01-final, < 4.3.15`\n- `DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `DotVVM 4.2.11`\n- `DotVVM 4.3.15`\n- `DotVVM 5.0.0-preview09-final`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}