--- title: GHSA-x65r-p6hf-94hv (avo): Missing authorization on Avo... description: Avo's association show endpoint skipped authorization checks, letting a signed-in user who could open a parent record also open every record associated with... canonical: https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-x65r-p6hf-94hv (avo): Missing authorization on Avo association show endpoint exposes related records | daily.dev og:description: Avo's association show endpoint skipped authorization checks, letting a signed-in user who could open a parent record also open every record associated with... og:url: https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy og:image: https://api.daily.dev/og/posts/NvPr9H3sy.png og:image:alt: GHSA-x65r-p6hf-94hv (avo): Missing authorization on Avo association show endpoint exposes related records og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-x65r-p6hf-94hv (avo): Missing authorization on Avo association show endpoint exposes related records **[RUBYLAND](https://daily.dev/sources/rubyla)** · 2 min read · 0 upvotes · 0 comments ## Summary Avo's association show endpoint skipped authorization checks, letting a signed-in user who could open a parent record also open every record associated with it. The route GET /resources/:resource_name/:id/:related_name/:related_id never checked the related resource's show? policy, its policy scope, or the parent's view_? check. This affects apps using a policy client, such as avo-authorization on Avo 4 or avo-pro on Avo 3, and has existed since avo 2.12.0. has_one fields on show pages are also affected since they load through the same route. It's a read-only issue rated CVSS 6.5 (Medium), fixed in avo 3.33.2 and 4.3.4. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is GHSA-x65r-p6hf-94hv in the avo gem? It is a missing authorization vulnerability in Avo's association show endpoint, GET /resources/:resource_name/:id/:related_name/:related_id. The route never checked the related resource's show? policy, its policy scope, or the parent's view_? check, letting a signed-in user view related records their policy should deny. It carries a CVSS score of 6.5 (Medium) and affects apps using avo-authorization on Avo 4 or avo-pro on Avo 3. _Teams running Avo admin panels can track gem security advisories like this one on daily.dev._ ### How do I fix the Avo missing authorization vulnerability on the association show route? Upgrade to avo 3.33.2 or later on the 3.x line, or 4.3.4 or later on the 4.x line. The flaw existed since avo 2.12.0 and only affects apps that use a policy client such as avo-authorization or avo-pro; apps without an authorization provider run no policies by design and are unaffected. _Developers patching Ruby gem vulnerabilities can follow advisories like this on daily.dev._ ### Does the Avo association endpoint vulnerability allow data modification? No, it is a read-only exposure. An attacker with scope access to a parent record, such as their own user record, could view all show-visible fields of any associated record, including tokens, financial fields, or personal data configured on that resource, but could not modify data through this flaw alone. _Developers assessing the blast radius of authorization bugs can watch for details like this on daily.dev._ ## Similar posts on daily.dev - [Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation](https://daily.dev/posts/missing-authorization-in-avo-association-attach-endpoint-allows-unauthorized-relationship-manipulati-riojrb5py) · RUBYLAND · 0 upvotes · 0 comments - [CVE-2026-33209 \(avo\): Avo has a XSS vulnerability on \`return\_to\` param](https://daily.dev/posts/cve-2026-33209-avo-avo-has-a-xss-vulnerability-on-return-to-param-pvema3sbe) · RUBYLAND · 0 upvotes · 0 comments - [Authorization testing in Rails](https://daily.dev/posts/authorization-testing-in-rails-wcdiqgboi) · Ruby Flow · 0 upvotes · 0 comments - [Access control for AI agents on Rails: gating SQL with Action Policy—Martian Chronicles, Evil Martians’ team blog](https://daily.dev/posts/access-control-for-ai-agents-on-rails-gating-sql-with-action-policy-martian-chronicles-evil-martia-efskld2gj) · Martian Chronicles · 0 upvotes · 0 comments - [GHSA-prq8-7wvh-44qh \(oauth\): Cross-origin OAuth token-request redirects can expose signed request metadata](https://daily.dev/posts/ghsa-prq8-7wvh-44qh-oauth-cross-origin-oauth-token-request-redirects-can-expose-signed-request-me-ktjgrr4kt) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-x65r-p6hf-94hv (avo): Missing authorization on Avo association show endpoint exposes related records","url":"https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy"},"datePublished":"2026-10-26T14:20:32.047Z","dateModified":"2026-10-26T14:20:58.895Z","description":"Avo's association show endpoint skipped authorization checks, letting a signed-in user who could open a parent record also open every record associated with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby,authorization","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-x65r-p6hf-94hv (avo): Missing authorization on Avo association show endpoint exposes related records"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-x65r-p6hf-94hv-avo-missing-authorization-on-avo-association-show-endpoint-exposes-related-re-nvpr9h3sy#faq","mainEntity":[{"@type":"Question","name":"What is GHSA-x65r-p6hf-94hv in the avo gem?","acceptedAnswer":{"@type":"Answer","text":"It is a missing authorization vulnerability in Avo's association show endpoint, GET /resources/:resource_name/:id/:related_name/:related_id. The route never checked the related resource's show? policy, its policy scope, or the parent's view_\u003cassociation\u003e? check, letting a signed-in user view related records their policy should deny. It carries a CVSS score of 6.5 (Medium) and affects apps using avo-authorization on Avo 4 or avo-pro on Avo 3. Teams running Avo admin panels can track gem security advisories like this one on daily.dev."}},{"@type":"Question","name":"How do I fix the Avo missing authorization vulnerability on the association show route?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to avo 3.33.2 or later on the 3.x line, or 4.3.4 or later on the 4.x line. The flaw existed since avo 2.12.0 and only affects apps that use a policy client such as avo-authorization or avo-pro; apps without an authorization provider run no policies by design and are unaffected. Developers patching Ruby gem vulnerabilities can follow advisories like this on daily.dev."}},{"@type":"Question","name":"Does the Avo association endpoint vulnerability allow data modification?","acceptedAnswer":{"@type":"Answer","text":"No, it is a read-only exposure. An attacker with scope access to a parent record, such as their own user record, could view all show-visible fields of any associated record, including tokens, financial fields, or personal data configured on that resource, but could not modify data through this flaw alone. Developers assessing the blast radius of authorization bugs can watch for details like this on daily.dev."}}]} ```