GHSA-c8qj-jx8j-fg2w: DotVVM: Missing authorization in AuthorizeActionFilter
Impact All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter. Patches DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this. Workarounds As a workaround, you can use the AuthorizeAttribute instead. It implements the same interfaces (correctly).
Published Jun 19, 2026
Affected packages
DotVVM
- Ecosystem
- NuGet
- Affected
- < 4.2.11
- Fixed in
- 4.2.11
- Check
dotnet list package --include-transitive
DotVVM
- Ecosystem
- NuGet
- Affected
- > 4.3.0-preview01-final, < 4.3.15
- Fixed in
- 4.3.15
- Check
dotnet list package --include-transitive
DotVVM
- Ecosystem
- NuGet
- Affected
- >= 5.0.0-preview01-final, < 5.0.0-preview09-final
- Fixed in
- 5.0.0-preview09-final
- Check
dotnet list package --include-transitive
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter.
Patches
DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this.
Workarounds
As a workaround, you can use the AuthorizeAttribute instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology