AIKIDO-2026-56599
avo is vulnerable to Insecure Direct Object Reference (IDOR)
83
High Risk
This Affects:
avoTL;DR
Avo's MediaLibraryController exposes index, show, update, and destroy endpoints for every ActiveStorage::Blob in the host application. Its only guard checks whether the Media Library feature is enabled, not whether the current user is authorized, so any authenticated Avo user can enumerate, read, rename, and permanently delete blobs belonging to records and tenants they cannot otherwise access. This cross-resource access bypasses the application's authorization. The fix makes the controller enforce the per-user visible? gate on every Media Library route.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have the Avo Media Library feature enabled.
Background info
avo is vulnerable to Insecure Direct Object Reference (IDOR) in versions 3.16.3 - 3.32.3 and 4.0.0 - 4.1.6.
How to fix this
Upgrade the avo library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant