---
title: "GHSA-c8qj-jx8j-fg2w: DotVVM: Missing authorization in AuthorizeActionFilter"
url: https://erroneo.us/security/ghsa/GHSA-c8qj-jx8j-fg2w/
description: "GHSA-c8qj-jx8j-fg2w (critical, NuGet): DotVVM: Missing authorization in AuthorizeActionFilter. Impact All users of the AuthorizeActionFilter class are…"
type: advisory
section: "Security Digest"
date_published: 2026-06-19
date_modified: 2026-06-19
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-c8qj-jx8j-fg2w"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-c8qj-jx8j-fg2w: DotVVM: Missing authorization in AuthorizeActionFilter

## Affected packages

- NuGet `DotVVM` < 4.2.11 → fixed: 4.2.11
- NuGet `DotVVM` > 4.3.0-preview01-final, < 4.3.15 → fixed: 4.3.15
- NuGet `DotVVM` >= 5.0.0-preview01-final, < 5.0.0-preview09-final → fixed: 5.0.0-preview09-final

## Details

Impact All users of the AuthorizeActionFilter class are affected. The AuthorizeActionFilter simply does nothing, no “hacking” is needed to bypass the filter. Patches DotVVM 4.3.15, 4.2.11 and 5.0.0-preview09 fix this. Workarounds As a workaround, you can use the AuthorizeAttribute instead. It implements the same interfaces (correctly). Note that is it deprecated for unrelated reasons, feel free to suppress the warning when using it as action filter.

## Sources

- [GitHub Advisory GHSA-c8qj-jx8j-fg2w](https://github.com/advisories/GHSA-c8qj-jx8j-fg2w)
- [github.com](https://github.com/riganti/dotvvm/security/advisories/GHSA-c8qj-jx8j-fg2w)

---
Source page: https://erroneo.us/security/ghsa/GHSA-c8qj-jx8j-fg2w/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt