Improper authorization control for web services In golang
Description
A flaw was found in Avo. An authenticated user could bypass server-side upload authorization and field-level upload policies. This allows them to replace or add attachment content, including binary content, filename, and content-type metadata, on a record. This could lead to unauthorized modification of data, particularly in multi-role deployments where specific per-record or per-field operations are expected to be enforced by policies.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Aliases
1. 2. 3. 4. 5.
References
1. 2.