CVE-2026-42205 - Vulnerability Analysis

Overview

Avo framework < 3.31.2 contains a broken access control vulnerability caused by insecure action lookup logic in ActionsController, letting authenticated users execute unauthorized actions on any resource, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can escalate privileges and manipulate data across the application without authorization.

Mitigation

Upgrade to version 3.31.2 or later.

References

• https://github.com/avo-hq/avo/releases/tag/v3.31.2
• https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner