CVE-2026-53769

A flaw was found in Avo. An authenticated user could bypass server-side upload authorization and field-level upload policies. This allows them to replace or add attachment content, including binary content, filename, and content-type metadata, on a record. This could lead to unauthorized modification of data, particularly in multi-role deployments where specific per-record or per-field operations are expected to be enforced by policies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.