CVE-2026-55518

Name of the Vulnerable Software and Affected Versions Avo versions prior to 3.32.1 Avo versions prior to 4.0.0.beta.51

Description A missing authorization check in the association attach workflow allows authenticated low-privileged users to bypass UI restrictions and directly attach related records to a parent record. While the UI and the GET /resources/:resource/:id/:related/new endpoint verify the attach <association>? permission, the write endpoint POST /resources/:resource/:id/:related does not perform this check before executing the Avo::AssociationsController#create function. This can lead to privilege escalation and cross-tenant data exposure if the associations represent authorization-bearing relationships such as roles, teams, or memberships.

Recommendations Update to version 3.32.1. Update to version 4.0.0.beta.51. As a temporary mitigation, restrict access to the POST /resources/:resource/:id/:related endpoint for low-privileged users.