CVE-2026-55518

🗓️ 17 Jul 2026 20:51:19Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 55 Views🌐 WEB

Avo allows unauthorized post attachment of associations, enabling privilege escalation; fixed in later versions.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-55518	17 Jul 202620:51	–	attackerkb
Circl	CVE-2026-55518	17 Jun 202606:07	–	circl
Cvelist	CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jul 202620:51	–	cvelist
EUVD	EUVD-2026-45334	17 Jul 202620:51	–	euvd
Github Security Blog	Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jun 202618:49	–	github
NVD	CVE-2026-55518	17 Jul 202621:17	–	nvd
OSV	CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jul 202620:51	–	osv
OSV	GHSA-8FQ9-273G-6MRG Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jun 202618:49	–	osv
Positive Technologies	PT-2026-50602	17 Jun 202600:00	–	ptsecurity
RubySec	Avo - Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jun 202600:00	–	rubygems

Vulners

Node

avo-hq avoRange4.0.0.beta.1–4.0.0.beta.51

avo-hq avoRange<3.32.1

[
  {
    "vendor": "avo-hq",
    "product": "avo",
    "versions": [
      {
        "version": ">= 4.0.0.beta.1, < 4.0.0.beta.51",
        "status": "affected"
      },
      {
        "version": "< 3.32.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/avo-hq/avo/commit/995928e586fd1788dd496bd51c4dbe4a79cb2b9c
github	www.github.com/avo-hq/avo/releases/tag/v3.32.1
github	www.github.com/avo-hq/avo/pull/4568
github	www.github.com/avo-hq/avo/security/advisories/GHSA-8fq9-273g-6mrg

Parameter	Position	Path	Description	CWE
<body parameters representing the association to attach>	request body	/resources/:resource/:id/:related	POST write endpoint bypasses authorization checks to mutate associations, enabling privilege escalation and cross-tenant data exposure.	CWE-863, CWE-862, CWE-639

23 Jul 2026 17:58Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.19.6

EPSS0.00331

SSVC

unauthorized attachment association attach privilege escalation cross tenant data Avo framework authorization bypass