CVE-2026-57578 DotVVM: Missing authorization in AuthorizeActionFilter

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

EUVD-2026-77700

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

CVE-2026-57578

DotVVM (open-source MVVM framework for .NET web applications) contains a missing-authorization flaw in its AuthorizeActionFilter prior to versions 4.2.11, 4.3.15, and 5.0.0-preview09-final. The filter's explicit implementations of ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilt...