CVE-2026-42205

RubyGems/avo CVE-2026-42205: high 8.8, EPSS 0.49%

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

Action: Upgrade avo to 3.31.2 or later.

bundle update avo

Affected

Fixed versions

Sources

• osv: GHSA-qc5p-3mg5-9fh8
• https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
• https://nvd.nist.gov/vuln/detail/CVE-2026-42205
• https://github.com/avo-hq/avo
• https://github.com/avo-hq/avo/releases/tag/v3.31.2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2026-42205.yml

CVE-2026-42205 · published 2026-04-24T16:11:28Z · modified 2026-06-08T23:30:14.465429678Z · JSON