Access Control Bypass Affecting view_component package, versions <3.25.0>=4.0.0.rc1, <4.12.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-VIEWCOMPONENT-17908091
- published9 Jul 2026
- disclosed8 Jul 2026
- creditcyberlanc3r
Introduced: 8 Jul 2026
NewCVE-2026-54497 (opens in a new tab)How to fix?
Upgrade view_component to version 3.25.0, 4.12.0 or higher.
Overview
Affected versions of this package are vulnerable to Access Control Bypass in the render_in. An attacker can access sensitive information or perform unauthorized actions by exploiting stale render context, which may include helpers, controller, request, view_flow, format/variant details, and slot child context from previous renders. This can result in privileged UI being rendered for lower-privileged users, generation of links with outdated Host headers, leakage of slot/helper state, and mixing of request context during concurrent rendering.