{{ message }}
Repository navigation
Security: avo-hq/avo
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationGHSA-8fq9-273g-6mrg published
Jun 17, 2026 by Paul-BobCritical -
Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyGHSA-pqpw-cvm4-8mv9 published
Jun 2, 2026 by Paul-BobModerate -
MediaLibraryController exposes every ActiveStorage::Blob to any authenticated Avo user (cross-resource IDOR)GHSA-cff8-4h3c-9r4q published
Aug 13, 2026 by Paul-BobHigh -
IDOR — Cross-tenant Active Storage Attachment Deletion in AvoGHSA-49qj-7hqj-6whp published
Aug 10, 2026 by Paul-BobHigh -
Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across ResourcesGHSA-qc5p-3mg5-9fh8 published
Apr 20, 2026 by adrianthedevHigh -
XSS vulnerability on return_to paramGHSA-762r-27w2-q22j published
Mar 17, 2026 by Paul-BobModerate -
stored cross-site scripting (XSS) in key_value fieldGHSA-ghjv-mh6x-7q6h published
Jan 16, 2024 by adrianthedevHigh -
Possible XSS in Action messagesGHSA-g8vp-2v5p-9qfh published
Jan 16, 2024 by adrianthedevModerate -
Possible unsafe reflection / partial DoSGHSA-86h2-2g4g-29qx published
Jun 5, 2023 by adrianthedevHigh -
Stored XSS (Cross Site Scripting) in html content based fieldsGHSA-5cr9-5jx3-2g39 published
Jun 5, 2023 by adrianthedevHigh
Learn more about advisories related to avo-hq/avo in the GitHub Advisory Database