CyberRota Analysis
AI-GeneratedAvo framework versions prior to 3.32.1 and 4.0.0.beta.51 are vulnerable due to insufficient authorization checks in the association attach workflow, allowing low-privileged authenticated users to manipulate related records via crafted POST requests. This flaw can lead to privilege escalation and unauthorized access to sensitive data across different tenants. Organizations using affected versions of Avo should prioritize updating to the patched versions to mitigate these critical security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.