Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: python314Packages.pandas-flavor

Found 1 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-55518
9.6 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 6 days, 8 hours ago Activity log
  • Created suggestion 6 days, 8 hours ago
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.

Affected products

avo
  • ==>= 4.0.0.beta.1, < 4.0.0.beta.51
  • ==< 3.32.1

Matching in nixpkgs

pkgs.havoc

Minimal terminal emulator for Wayland

pkgs.flavours

Easy to use base16 scheme manager/builder that integrates with any workflow

pkgs.endeavour

Personal task manager for GNOME

  • nixos-unstable 43.0
    • nixpkgs-unstable 43.0
    • nixos-unstable-small 43.0
  • nixos-26.05 43.0
    • nixos-26.05-small 43.0
    • nixpkgs-26.05-darwin 43.0

pkgs.pavolctld

Minimal volume control/monitoring daemon for PulseAudio and PipeWire

pkgs.gnomeExtensions.favorites-menu

Minimalist favorites menu button in top panel.

  • nixos-unstable 2
    • nixpkgs-unstable 2
    • nixos-unstable-small 2
  • nixos-26.05 2
    • nixos-26.05-small 2
    • nixpkgs-26.05-darwin 2

pkgs.gnomeExtensions.fullscreen-avoider

Moves the top panel to the secondary monitor if the primary is in fullscreen

  • nixos-unstable 16
    • nixpkgs-unstable 16
    • nixos-unstable-small 16
  • nixos-26.05 16
    • nixos-26.05-small 16
    • nixpkgs-26.05-darwin 16

Package maintainers