CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
An authenticated low-privileged user can bypass UI controls to manipulate associations via direct POST requests, leading to privilege escalation and data exposure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55518?
CVE-2026-55518 is a critical missing authorization vulnerability in avo-hq avo, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.
Which versions are affected by CVE-2026-55518?
4 open source packages ship an affected version, including avo.
| Package | Affected | Fixed in |
|---|---|---|
avo RubyGems | All versions | 3.32.1 |
avo RubyGems | All versions | 3.32.1 |
avo RubyGems | From 4.0.0.beta.1 | 4.0.0.beta.51 |
avo RubyGems | From 4.0.0.beta.1 | 4.0.0.beta.51 |
How do I fix CVE-2026-55518?
Upgrade avo to a fixed version for your release line: 3.32.1 or 4.0.0.beta.51.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55518 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55518 exists.
Sources
Also known as GHSA-8fq9-273g-6mrg.