CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy
Authenticated users can bypass upload policies to modify attachment content on records, affecting Avo admin panel deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53769?
CVE-2026-53769 is a medium-severity missing authorization vulnerability in avo-hq avo, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.
Which versions are affected by CVE-2026-53769?
2 open source packages ship an affected version, including avo.
| Package | Affected | Fixed in |
|---|---|---|
avo RubyGems | From 2.28.0 | 3.32.0 |
avo RubyGems | From 2.28.0 | 3.32.0 |
How do I fix CVE-2026-53769?
Upgrade avo to 3.32.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-53769 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53769 exists.
Sources
Also known as GHSA-pqpw-cvm4-8mv9.