CVE-2026-57578 in DotVVM
Summary
by MITRE • 09/14/2026
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync implementations return completed tasks instead of invoking the corresponding checks. Applications relying on this filter can therefore expose protected commands, view models, or presenters to unauthorized requests without any special bypass technique. AuthorizeAttribute correctly implements the same interfaces and can be used as a workaround. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within DotVVM, an open-source Model-View-ViewModel framework for building web applications, represents a critical failure in access control mechanisms that can lead to unauthorized data exposure or functionality abuse. The core of the issue lies in the implementation of the AuthorizeActionFilter class, which is designed to enforce security policies on incoming requests by validating user permissions before allowing specific actions to proceed. In versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, this filter fails to perform any actual authorization checks due to a coding error in its lifecycle method implementations. Specifically, the methods OnCommandExecutingAsync, OnViewModelCreatedAsync, and OnPresenterExecutingAsync are intended to intercept requests at critical stages of the application flow and verify whether the current user has the necessary privileges to execute the associated command, view model, or presenter logic. Instead of invoking these security checks, the flawed implementations simply return completed tasks immediately, effectively bypassing all authentication and authorization logic without raising any errors or exceptions that would alert developers or administrators to the failure.
This technical flaw results in a complete breakdown of access control for any application component protected by the AuthorizeActionFilter. Because the filter returns successfully regardless of the user's identity or role status, attackers can send crafted requests to endpoints secured by this mechanism and gain unauthorized access to sensitive data or administrative functions. This scenario aligns with CWE-284 Improper Access Control, as the system fails to restrict resources according to authorized users. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Privilege Escalation and Unauthorized Access via API endpoints. Attackers do not need complex exploitation chains or side-channel attacks; they simply interact with the application normally, but target protected routes that should have been blocked by the filter. The absence of any error response makes detection even more difficult for security monitoring tools, as the requests appear to be legitimate successful operations rather than failed attempts at unauthorized access.
The operational impact of this vulnerability is severe, particularly in enterprise environments where DotVVM is used to build internal dashboards or customer-facing portals with role-based access control. If an application relies on AuthorizeActionFilter to protect sensitive endpoints such as user profile modifications, financial transactions, or administrative configuration pages, those protections are effectively nullified. This can lead to data breaches involving personally identifiable information, regulatory non-compliance with standards like GDPR or HIPAA depending on the nature of the exposed data, and potential integrity issues if attackers modify critical system states. The vulnerability persists across multiple major version branches, indicating a systemic issue in how these specific filter interfaces were implemented during that development cycle. It is important to note that this flaw does not affect all components equally; only those explicitly using AuthorizeActionFilter are vulnerable, while other security mechanisms like the AuthorizeAttribute remain functional and correctly implement the same interfaces for validation.
To mitigate this risk, organizations must immediately upgrade their DotVVM dependencies to version 4.2.11 or later, specifically targeting versions 4.3.15 and 5.0.0-preview09-final which contain the corrected implementations of the authorization filters. For applications that cannot be updated instantly due to compatibility constraints with other libraries, a temporary workaround involves replacing instances of AuthorizeActionFilter with the AuthorizeAttribute in configuration files or code-behind logic where access control is defined. This attribute correctly invokes the necessary security checks and will restore proper enforcement of user permissions until an upgrade can be performed. Additionally, developers should conduct a thorough audit of their application's routing and filter configurations to ensure no other custom filters suffer from similar implementation errors where async methods return completed tasks without performing required logic. Regular penetration testing focused on access control bypasses is also recommended to verify that security controls are functioning as intended after remediation efforts are applied.