CVE-2026-53769 describes a missing authorization vulnerability (CWE-862) in the Avo framework for Ruby on Rails, specifically affecting the direct attachment upload endpoint. From version 2.28.0 to before 3.32.0, this endpoint does not enforce server-side upload authorization and bypasses documented field-level upload policy methods such as upload_{FIELD_ID}?. Authenticated users who can reach this endpoint can modify or add attachments, including binary content and metadata, on resolved records regardless of the update? and upload_<field>? policy restrictions. This primarily affects multi-role Avo Pro/Advanced deployments where non-administrator users should have restricted upload capabilities. The vulnerability was patched in version 3.32.0.

The vulnerability allows authenticated users with access to the Avo attachment upload endpoint to bypass intended upload restrictions and replace or add attachment content on records even when policies deny such operations. This can lead to unauthorized modification of attachments, potentially impacting data integrity and trustworthiness of records in affected deployments. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

This vulnerability has been officially fixed in Avo version 3.32.0. Users should upgrade to version 3.32.0 or later to remediate this issue. No additional mitigation is required once the update is applied.