AIKIDO-2026-597928

avo is vulnerable to Insecure Direct Object Reference (IDOR)

Insecure Direct Object Reference (IDOR)GHSA-49qj-7hqj-6whp Published Aug 12, 2026

High Risk

This Affects:

avo

2.0.0 - 3.32.1

Fixed in 3.32.2

4.0.0 - 4.1.4

Fixed in 4.1.5

Are you affected? Scan for Free

TL;DR

The AttachmentsController#destroy endpoint in the Avo admin framework authorizes the delete policy against the parent record taken from the URL but then resolves the attachment through a global, unscoped ActiveStorage::Attachment.find on the user-supplied attachment ID. An authenticated user who holds delete permission on any single record can pass that check and then supply a different record's attachment ID. This permanently destroys Active Storage attachments belonging to other records, models, and tenants. The fix validates the attachment name and scopes the lookup to the authorized record's association before destroying it.

Who does this affect?

You are affected if you are using a version within the vulnerable range and if your application mounts Avo's admin interface with Active Storage attachments and grants users delete permission on any record.