Authorization Bypass in DotVVM Framework by Riganti
CVE-2026-57578
What is CVE-2026-57578?
A vulnerability in the DotVVM framework could allow unauthorized actions due to the failure of the AuthorizeActionFilter to enforce authorization on the ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync methods. This issue permits attackers to exploit protected commands, view models, or presenters without requiring any specific bypass technique. The vulnerability impacts applications using affected versions prior to updates 4.2.11, 4.3.15, and 5.0.0-preview09-final. To mitigate this issue, users are encouraged to adopt the AuthorizeAttribute, which correctly implements the required authorization checks.
Affected Version(s)
dotvvm < 4.2.11 < 4.2.11
dotvvm >= 4.3.0, < 4.3.15 < 4.3.0, 4.3.15
dotvvm >= 5.0.0-preview01, < 5.0.0-preview09-final < 5.0.0-preview01, 5.0.0-preview09-final