GitHub Advisoryadvisory · Packagist

GHSA-7q3w-xqjw-g3cr Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

MEDIUM Published 2026-06-11 Modified 2026-07-18 Official page ↗
Aliases
CVE-2026-48067
Ecosystem
Packagist
Packages
filament/tables, filament/actions
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-639
Reviewed
2026-06-11

Affected packages

• Packagist filament/tables: >= 3.0.0, < 3.3.51 → fixed in 3.3.51 • Packagist filament/actions: >= 4.0.0, < 4.11.4 → fixed in 4.11.4 • Packagist filament/actions: >= 5.0.0, < 5.6.4 → fixed in 5.6.4

Description

The `recordSelectOptionsQuery()` method may be used to scope the options available in the `Select` field for `AttachAction` and `AssociateAction`. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value.

Related

Alias · CVE (1)

  • CVE-2026-48067 Filament is a collection of full-stack components for accelerated Laravel development. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References