What is GHSA-c8qj-jx8j-fg2w?

GHSA-c8qj-jx8j-fg2w is a security advisory published by GitHub Security Advisories with Critical severity. DotVVM: Missing authorization in AuthorizeActionFilter

Why does GHSA-c8qj-jx8j-fg2w have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-c8qj-jx8j-fg2w?

GHSA-c8qj-jx8j-fg2w affects 3 products, including: nuget/DotVVM:\u003c 4.2.11; nuget/DotVVM:\u003e 4.3.0-preview01-final, \u003c 4.3.15; nuget/DotVVM:\u003e= 5.0.0-preview01-final, \u003c 5.0.0-preview09-final.

GHSA-c8qj-jx8j-fg2wCriticalDisclosed before NVD

DotVVM: Missing authorization in AuthorizeActionFilter

Vendor

GitHub Security Advisories

Published

June 19, 2026

Last Modified

June 19, 2026

📋 Description

Impact

All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter.

Patches

DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this.

Workarounds

As a workaround, you can use the AuthorizeAttribute instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.

🎯 Affected products3

nuget/DotVVM:< 4.2.11
nuget/DotVVM:> 4.3.0-preview01-final, < 4.3.15
nuget/DotVVM:>= 5.0.0-preview01-final, < 5.0.0-preview09-final

🔗 References (2)

https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w
https://github.com/advisories/GHSA-c8qj-jx8j-fg2w