An authenticated user can trigger any Action class within the Avo framework, regardless of whether that action is registered for the target resource. This insecure lookup bypass places privilege escalation in the hands of attackers, enabling them to manipulate data across the application. The flaw stems from broken access control in the ActionsController.

Avo framework version 3.31.1 and earlier used in Ruby on Rails projects. Since the issue was fixed in version 3.31.2, all installations running a prior version are affected.

The CVSS score of 8.8 places the vulnerability in the high range, and its exploitability requires only that the attacker has a valid authenticated session. With no EPSS data and no KEV listing, the broader risk depends on the security posture of the application, but the potential for unauthorized data manipulation across the entire app makes it a significant concern.