# CVE-2026-42205: avo PrivEsc — Fixed in 3.31.2

💎

💎 RubyGems

Not in CISA KEV

HIGH severity

# CVE-2026-42205 — avo

HIGH 

CVE-2026-42205 is a high-severity (CVSS 8.8) CWE-284 vulnerability in avo. A fix is available for avo — see the affected versions and patch details below.

Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources

Also known as[GHSA-qc5p-3mg5-9fh8](/vulnerability/GHSA-qc5p-3mg5-9fh8)

Published

May 8, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
-   A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42205.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.3%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs22th percentile — riskier than 22% of all scored CVEsHighest risk

0.00%0.33%0.66%0.99%0.0%0.3%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

💎`avo`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

A critical Broken Access Control vulnerability was identified in the `ActionsController` of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of `Avo::BaseAction`) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application.

#### Details

The vulnerability exists in the `action_class` method within `app/controllers/avo/actions_controller.rb`.

#### Vulnerable Code

```
def action_class
  # It searches through ALL descendants of BaseAction without resource validation
  Avo::BaseAction.descendants.find do |action|
    action.to_s == params[:action_id]
  end
end
```

The controller identifies the action class to execute solely based on the `params[:action_id]` by searching through all `BaseAction` descendants. It fails to verify whether the requested action is actually permitted or registered for the resource context specified in the request URL (e.g., `/admin/resources/posts/actions`).

Consequently, an attacker can invoke sensitive actions (e.g., `Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint (e.g., `Post`), bypassing the intended resource-action mapping.

#### Impact

This flaw results in significant security risks:

-   **Privilege Escalation:** An authenticated user with low privileges can execute administrative actions (like toggling admin roles) to escalate their own or others' permissions.
-   **Unauthorized Operations:** Actions designed for restricted resources can be triggered against any record ID in the database.
-   **Data Integrity Compromise:** Attackers can perform unauthorized destructive operations (e.g., Delete, Archive, or Update) on records they should not have access to.

#### Proof of Concept (PoC)

**Steps to Reproduce:**

1.  Log in to the Avo admin panel with limited permissions.
2.  Identify a target record ID (e.g., User ID: 1) and a sensitive action class (e.g., `Avo::Actions::ToggleAdmin`).
3.  Send a POST request to a resource endpoint where the target action is not registered:
    -   **URL:** `POST /admin/resources/posts/actions`
    -   **Payload:** `action_id=Avo::Actions::ToggleAdmin&fields[avo_resource_ids]=1`
4.  The server executes the `ToggleAdmin` logic on User 1, even though the request was made through the `posts` resource context.

**PoC Script Snippet:**

```
# Simulating the unauthorized action execution
data = {
    'action_id': 'Avo::Actions::ToggleAdmin',
    'fields[avo_resource_ids]': '1', # Target Record ID
    'authenticity_token': csrf_token
}
response = session.post(f"{BASE_URL}/admin/resources/posts/actions", data=data)
```

#### Remediation

Restrict the action lookup to only those actions explicitly registered for the current resource context:

```
def action_class
  # Validate that the action is registered for the current resource
  @resource.get_actions.find do |action|
    action.to_s == params[:action_id]
  end
end
```

#### Discoverer

Illunight

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

💎RubyGems

`avo` 

all versions

3.31.2`bundle update avo --conservative`

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for avo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update avo to 3.31.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42205 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
    

## Frequently Asked Questions

\### Summary A critical Broken Access Control vulnerability was identified in the \`ActionsController\` of the Avo framework (v3.x). Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of \`Avo::BaseAction\`) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. ### Details The vulnerability exists in the \`action\_class\` method within \`app/controllers/avo/actions\_controller.rb\`. #### Vulnerable Code \`\`\`ruby def action\_c

O3 Security · Impact-Aware SCA

### Is CVE-2026-42205 in your dependencies?

Find it across RubyGems, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)