CVE-2026-53769

Name of the Vulnerable Software and Affected Versions Avo versions 2.28.0 through 3.31.x

Description Avo's direct attachment upload endpoint lacks server-side authorization, allowing authenticated users to bypass documented field-level upload policies. An attacker can replace or add attachment content, including binary data, filenames, and content-type metadata, on a record even if the update? and upload {FIELD ID}? policies are set to deny the operation. This issue primarily affects multi-role deployments where restricted operator users are expected to be limited by per-record or per-field policies.

The vulnerability exists in the Avo::AttachmentsController#create function, which processes requests at the endpoint POST /<avo-root>/avo api/resources/:resource name/:id/attachments/. The system creates an ActiveStorage::Blob before validating the attachment association or enforcing authorization, failing to call the necessary authorization methods to verify if the user has permission to upload to the specific field.

Recommendations Update Avo to version 3.32.0. As a temporary mitigation, restrict access to Avo routes so that only fully trusted administrators can reach them.