PT-2026-57041

Name of the Vulnerable Software and Affected Versions Avo versions 2.28.0 through 3.31.x Description Avo's direct attachment upload endpoint lacks server-side authorization, allowing authenticated users to bypass documented field-level upload policies. An attacker can replace or add attachment...

CVE-2024-1314

The attachment file of an existing record can be replaced if the user has ""read"" permission on one of the parent collection or bucket. And if the ""read"" permission is given to ""system.Everyone"" on one of the parent, then the attachment can be replaced on a record using an anonymous request...