{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "2.28.0"
              },
              {
                "fixed": "3.32.0"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "39f6f8e1d24247749fdad1e1d1be13323f09f7c7"
            },
            {
              "fixed": "2aa06624ef6cf7bfd6657cf5b25a2afab29e189d"
            }
          ],
          "repo": "https://github.com/avo-hq/avo",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-pqpw-cvm4-8mv9"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53769.json"
  },
  "details": "Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_\u003cfield\u003e? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.",
  "id": "CVE-2026-53769",
  "modified": "2026-09-06T03:30:20.223249196Z",
  "published": "2026-09-04T20:02:01.456Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/avo-hq/avo/releases/tag/v3.32.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53769.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/avo-hq/avo/security/advisories/GHSA-pqpw-cvm4-8mv9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53769"
    },
    {
      "type": "FIX",
      "url": "https://github.com/avo-hq/avo/commit/de12070dbac0cb6a7e2bea357f9697f99e92554c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/avo-hq/avo/pull/4520"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy"
}