CVE-2026-57578 describes a missing authorization vulnerability (CWE-862) in the riganti dotvvm framework. Specifically, in versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, the AuthorizeActionFilter's implementations of ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync do not invoke authorization checks but instead return completed tasks immediately. This flaw allows unauthorized requests to access protected commands, view models, or presenters without requiring any bypass technique. The AuthorizeAttribute correctly implements these interfaces and can be used as a workaround. The vulnerability is resolved in the fixed versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Exploitation of this vulnerability allows unauthorized users to access protected commands, view models, or presenters in applications using the affected versions of dotvvm. This can lead to unauthorized actions and data exposure without requiring any special bypass techniques. The CVSS 4.0 score of 9.2 (critical) reflects the high impact due to network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Upgrade dotvvm to version 4.2.11, 4.3.15, or 5.0.0-preview09-final or later, where this issue is fixed. As a temporary workaround, use the AuthorizeAttribute instead of relying solely on the AuthorizeActionFilter to enforce authorization checks. No other special mitigation is indicated by the vendor advisory.