{"items":[{"id":"NVI-00017795","kind":"vulnerability","title":"Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pqpw-cvm4-8mv9","CVE-2026-53769"],"plain_summary":"GitHub lists this reviewed advisory for avo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-67e392eeca42cacf4bcaae4b6272e865"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-09T20:54:11.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-67e392eeca42cacf4bcaae4b6272e865"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-67e392eeca42cacf4bcaae4b6272e865","url":"https://github.com/advisories/GHSA-pqpw-cvm4-8mv9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pqpw-cvm4-8mv9","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:40.400Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-67e392eeca42cacf4bcaae4b6272e865"],"technology":"avo","known_exclusions":[],"conditions_summary":"### Summary\n\nAvo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as `upload_{FIELD_ID}?`.\n\nAn authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both `update?` and `upload_?` policies deny the operation.\n\nThis primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies.\n\n### Details\n\nAvo exposes a direct attachment upload endpoint:\n\n```text\nPOST //avo_api/resources/:resource_name/:id/attachments/\n```\n\nThe vulnerable code path is `Avo::AttachmentsController#create`:\n\n- `app/controllers/avo/attachments_controller.rb:9-24`\n\nCurrent behavior:\n\n```ruby\ndef create\n  blob = ActiveStorage::Blob.create_and_upload! io: params[:file].to_io, filename: params[:filename]\n  association_name = BaseResource.valid_attachment_name(@record, params[:attachment_key])\n\n  if association_name\n    @r","public_affected_ranges":[">= 2.28.0, < 3.32.0"]}],"null_published_at":"2026-11-05T19:10:21.469Z","source_updated_at":"2026-07-09T20:54:11.000Z","source_disclosed_at":"2026-07-09T20:54:10.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:40.400Z"}],"next_cursor":null,"snapshot_revision":"42594"}