Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-my8d-sdub-tuf5
Vulnerability ID VCID-my8d-sdub-tuf5
Aliases CVE-2026-42205
GHSA-qc5p-3mg5-9fh8
Summary Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-284 Improper Access Control
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2026-42205
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2026-42205
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2026-42205
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qc5p-3mg5-9fh8
cvssv3.1 8.8 https://github.com/avo-hq/avo
generic_textual HIGH https://github.com/avo-hq/avo
cvssv3.1 8.8 https://github.com/avo-hq/avo/releases/tag/v3.31.2
generic_textual HIGH https://github.com/avo-hq/avo/releases/tag/v3.31.2
ssvc Track* https://github.com/avo-hq/avo/releases/tag/v3.31.2
cvssv3 8.8 https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
cvssv3.1 8.8 https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
cvssv3.1_qr HIGH https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
generic_textual HIGH https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
ssvc Track* https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
cvssv3.1 8.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2026-42205
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-42205
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-42205
https://github.com/avo-hq/avo
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml
https://nvd.nist.gov/vuln/detail/CVE-2026-42205
GHSA-qc5p-3mg5-9fh8 https://github.com/advisories/GHSA-qc5p-3mg5-9fh8
GHSA-qc5p-3mg5-9fh8 https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
v3.31.2 https://github.com/avo-hq/avo/releases/tag/v3.31.2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/avo-hq/avo
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/avo-hq/avo/releases/tag/v3.31.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-12T12:51:27Z/ Found at https://github.com/avo-hq/avo/releases/tag/v3.31.2
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-12T12:51:27Z/ Found at https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-42205
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.16036
EPSS Score 0.0005
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:20.773504+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/42xxx/CVE-2026-42205.json 38.6.0