Security: avo-hq/avo
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationGHSA-8fq9-273g-6mrg published
Jun 17, 2026 by Paul-BobCritical -
Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyGHSA-pqpw-cvm4-8mv9 published
Jun 2, 2026 by Paul-BobModerate -
Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across ResourcesGHSA-qc5p-3mg5-9fh8 published
Apr 20, 2026 by adrianthedevHigh -
XSS vulnerability on return_to paramGHSA-762r-27w2-q22j published
Mar 17, 2026 by Paul-BobModerate -
stored cross-site scripting (XSS) in key_value fieldGHSA-ghjv-mh6x-7q6h published
Jan 16, 2024 by adrianthedevHigh -
Possible XSS in Action messagesGHSA-g8vp-2v5p-9qfh published
Jan 16, 2024 by adrianthedevModerate -
Possible unsafe reflection / partial DoSGHSA-86h2-2g4g-29qx published
Jun 5, 2023 by adrianthedevHigh -
Stored XSS (Cross Site Scripting) in html content based fieldsGHSA-5cr9-5jx3-2g39 published
Jun 5, 2023 by adrianthedevHigh