CVE-2026-55518: Authorization Bypass Through User-Controlled Key

🗓️ 17 Jul 2026 00:00:00Reported by Rapid7Type

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_ ? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, PO...

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2026-55518	17 Jul 202620:51	–	attackerkb
Circl	CVE-2026-55518	17 Jun 202606:07	–	circl
CVE	CVE-2026-55518	17 Jul 202620:51	–	cve
Cvelist	CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jul 202620:51	–	cvelist
EUVD	EUVD-2026-45334	17 Jul 202620:51	–	euvd
Github Security Blog	Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jun 202618:49	–	github
NVD	CVE-2026-55518	17 Jul 202621:17	–	nvd
OSV	GHSA-8FQ9-273G-6MRG Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jun 202618:49	–	osv
Positive Technologies	PT-2026-50602	17 Jun 202600:00	–	ptsecurity
RubySec	Avo - Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation	17 Jun 202600:00	–	rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55518
cwe	www.cwe.mitre.org/data/definitions/639.html
cwe	www.cwe.mitre.org/data/definitions/863.html
cwe	www.cwe.mitre.org/data/definitions/862.html

23 Jul 2026 00:00Current

CVSS 3.19.6

EPSS0.00448

SSVC