CVE-2026-57578: DotVVM: Missing authorization in AuthorizeActionFilter
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DotVVMto a version that resolves this vulnerability.Fixed in 4.2.11 - Upgrade
Upgrade
DotVVMto a version that resolves this vulnerability.Fixed in 4.3.15 - Upgrade
Upgrade
DotVVMto a version that resolves this vulnerability.Fixed in 5.0.0-preview09-final - Compensating control
Use AuthorizeAttribute as a workaround for DotVVM: Missing authorization in AuthorizeActionFilter, since it correctly implements the same interfaces and can be used to enforce authorization despite AuthorizeActionFilter not performing checks in affected versions.
Event History
Frequently Asked Questions
Which applications are exposed?
Applications that rely on AuthorizeActionFilter to protect commands, view models, or presenters are exposed in DotVVM versions before 4.2.11, 4.3.15, and 5.0.0-preview09-final.
What does an attacker need to exploit this issue?
An attacker only needs to send an unauthorized request to functionality protected solely by AuthorizeActionFilter. No special authorization-bypass technique is required because the filter does not invoke its authorization checks.
What can be done if upgrading is not immediately possible?
Use AuthorizeAttribute instead of AuthorizeActionFilter for the affected protections. AuthorizeAttribute correctly implements the relevant filter interfaces and is identified as a workaround.
How can we determine whether our application is affected?
Review the application for uses of AuthorizeActionFilter on commands, view models, or presenters, and check the deployed DotVVM version. Deployments earlier than the fixed releases are affected where this filter is relied on for authorization.