CVE-2026-57578

DotVVM, an open-source MVVM framework for .NET web applications, ships an AuthorizeActionFilter that performs no authorization at all: its implementations of ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and IPresenterActionFilter.OnPresenterExecutingAsync return already-completed tasks instead of invoking the authorization checks. Any application that relies on this filter to guard commands, view models, or presenters exposes those resources to unauthenticated or unauthorized remote requests — no special bypass technique is required, just sending a normal request to a protected endpoint. An attacker gains full access to whatever the filter was meant to protect, which can mean exposure of sensitive data or privileged operations (CVSS 4.0: 9.2, CWE-862 missing authorization). All DotVVM versions before 4.2.11, 4.3.0–4.3.14, and 5.0.0 previews before 5.0.0-preview09-final are affected. No public proof of concept is known and there is no evidence of in-the-wild exploitation to date, but the bug is trivially exploitable by anyone who discovers a dependent application.

What to do: Upgrade DotVVM to 4.2.11 or 4.3.15 (or 5.0.0-preview09-final if on the 5.0 preview track) as soon as possible. If immediate upgrade is not possible, replace AuthorizeActionFilter with AuthorizeAttribute, which correctly implements the same filter interfaces. Audit application logs and traffic for unauthorized access to previously protected commands, view models, and presenters, since the flaw leaves no bypass artifact — affected endpoints simply accepted every request.