CVE-2026-48067CWE-639

Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields

Medium · published June 22, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-22T21:46Z
EPSS history
Timeline
  • 22 JUN 21:46Z
    Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields
    cvelistv5