---
id: GHSA-c8qj-jx8j-fg2w
title: 'DotVVM: Missing authorization in AuthorizeActionFilter'
summary: 'DotVVM: Missing authorization in AuthorizeActionFilter'
severity: critical
cwe:
  - CWE-862
vendor: DotVVM
product: DotVVM
affected:
  - DotVVM < 4.2.11
  - 'DotVVM > 4.3.0-preview01-final, < 4.3.15'
  - 'DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final'
patched:
  - DotVVM 4.2.11
  - DotVVM 4.3.15
  - DotVVM 5.0.0-preview09-final
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-c8qj-jx8j-fg2w'
references:
  - url: 'https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w'
  - url: 'https://github.com/advisories/GHSA-c8qj-jx8j-fg2w'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T15:52:21.101Z'
ecosystem: nuget
---

## Overview

### Impact

All users of the `AuthorizeActionFilter` class are affected. The `AuthorizeActionFilter` simply does nothing, no “hacking” is needed to bypass the filter.

### Patches

DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this.

### Workarounds

As a workaround, you can use the `AuthorizeAttribute` instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.

## Affected packages

- `DotVVM < 4.2.11`
- `DotVVM > 4.3.0-preview01-final, < 4.3.15`
- `DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final`

## Remediation

Upgrade to a patched release:

- `DotVVM 4.2.11`
- `DotVVM 4.3.15`
- `DotVVM 5.0.0-preview09-final`