Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps

Avo HQ released a patch for CVE-2026-55518, a critical (CVSS 9.6) authorization bypass in the Avo admin panel framework for Ruby on Rails that allows authenticated low-privileged users to bypass attach authorization by sending crafted POST requests to association endpoints, potentially enabling privilege escalation and cross-tenant data exposure; affected versions are ≤3.32.0 and 4.0.0-beta.1 through 4.0.0-beta.50, fixed in 3.32.1 and 4.0.0-beta.51 — upgrade immediately.