Avo is a framework for building admin panels in Ruby on Rails. Before version 3.32.1 and 4.0.0.beta.51, the framework’s association attach workflow performs a check for an attach_<association> parameter in the UI and the GET /resources/:resource/:id/:related/new endpoint. However, the actual write operation on POST /resources/:resource/:id/:related is handled by Avo::AssociationsController#create and lacks the same authorization verification. An authenticated user with lower privileges can therefore send a crafted POST request to attach any related record to a parent, bypassing hidden or disabled UI controls. This unauthorized manipulation can result in privilege escalation and cross‑tenant data exposure when the associations carry authorization‑bearing relationships.

The affected product is Avo (avo-hq:avo). Versions prior to 3.32.1 and 4.0.0.beta.51 are vulnerable. All installations of these versions that expose the resource association endpoints are at risk.

The vulnerability carries a CVSS score of 9.6, indicating critical severity. EPSS is below 1 %, showing a low but non‑zero likelihood of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user sending a crafted POST request to the /resources/:resource/:id/:related endpoint, inferred from the description. An attacker must first be authenticated within Avo; thereafter, by posting to /resources/:resource/:id/:related the attacker can manipulate associations and potentially gain higher privileges or access data outside their tenant. The flaw is exploitable without requiring additional privileges beyond the authenticated low‑privileged user, making it a significant risk for applications that rely on strict ownership checks for associations.