CVE-2026-10284: DevaslanPHP Auth Bypass Vulnerability

CVE-2026-10284 Overview

CVE-2026-10284 is an improper authorization flaw [CWE-266] in the DevaslanPHP project-management application up to version 2.0.0-beta1. The vulnerability resides in the editComment and doDeleteComment functions within app/Filament/Resources/TicketResource/Pages/ViewTicket.php, part of the Livewire Handler component. An authenticated remote attacker can manipulate these handlers to modify or delete comments belonging to other users. The issue was reported to the project maintainers via a public issue, but no vendor response has been recorded at the time of disclosure.

Critical Impact
Authenticated remote attackers can edit or delete tickets comments belonging to other users, breaking integrity controls within the project management workflow.

Affected Products

DevaslanPHP project-management up to and including 2.0.0-beta1
Component: Livewire Handler (ViewTicket.php)
Functions: editComment, doDeleteComment

Discovery Timeline

2026-06-01 - CVE-2026-10284 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10284

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Livewire component that handles ticket comments. The editComment and doDeleteComment methods in app/Filament/Resources/TicketResource/Pages/ViewTicket.php accept comment identifiers from client input and act on the corresponding records without verifying that the requesting user owns the comment or has the required role. Because Livewire exposes server-side methods directly to authenticated clients, any logged-in user can invoke these handlers with arbitrary comment IDs. The flaw is categorized under [CWE-266] Incorrect Privilege Assignment, reflecting that operations restricted to comment authors are reachable by lower-privileged accounts.

Root Cause

The root cause is the absence of an ownership or policy check before mutating comment state. Laravel and Filament provide Policy classes and authorize() helpers, but these were not applied to the affected Livewire actions. As a result, the application relies solely on the authenticated session rather than on per-resource authorization. EPSS data places the probability of exploitation at 0.043% (percentile 13.373), consistent with a vulnerability that requires authentication and produces limited integrity impact.

Attack Vector

The attack is remote and requires only low-privilege authenticated access. An attacker logs into the project management application, observes the Livewire payload structure used by the ticket view page, then issues a crafted Livewire request referencing a comment ID owned by another user. The server executes editComment or doDeleteComment against the target record without rejecting the request. Confidentiality is not affected, but integrity and availability of comment data are degraded. See the GitHub Issue #140 Discussion for the original report and the VulDB CVE-2026-10284 Entry for additional context.

Detection Methods for CVE-2026-10284

Indicators of Compromise

Livewire POST requests to ticket view endpoints invoking editComment or doDeleteComment with comment IDs not associated with the requesting user.
Audit log entries showing comment modifications or deletions performed by users other than the original author.
Unexpected spikes in PATCH or DELETE-equivalent Livewire actions on the TicketResource pages.

Detection Strategies

Correlate authenticated session identifiers with comment ownership records in application logs to surface mismatches.
Instrument the editComment and doDeleteComment methods with logging that captures actor user ID, target comment ID, and target comment owner.
Review web server access logs for repeated Livewire calls targeting sequential comment IDs, a pattern indicative of enumeration.

Monitoring Recommendations

Forward application and web server logs to a centralized analytics platform and alert on author-versus-actor mismatches for comment operations.
Monitor for accounts performing an unusually high volume of comment edits or deletions within short time windows.
Track issue tracker integrity by establishing a baseline of comment churn per project and alerting on deviations.

How to Mitigate CVE-2026-10284

Immediate Actions Required

Restrict access to the project-management application to trusted users only until a patch is available, given that exploitation requires authentication.
Add a Laravel Policy or inline ownership check to the editComment and doDeleteComment methods, rejecting requests where the comment author does not match the authenticated user.
Audit existing comment records for unauthorized modifications by comparing audit trail metadata against current values.

Patch Information

No official vendor patch has been released. According to the CVE description and the GitHub Issue #140 Discussion, the maintainers were notified through an issue report but have not responded. Operators should track the GitHub Project Management Repository for fixes and consider applying a local patch that calls $this->authorize('update', $comment) and $this->authorize('delete', $comment) inside the affected Livewire methods.

Workarounds

Apply a forked patch that enforces ownership checks in ViewTicket.php before any comment mutation.
Disable comment editing and deletion features at the route or middleware layer if the workflow does not require them.
Place the application behind an authenticated reverse proxy that logs and rate-limits Livewire endpoints, reducing the blast radius of unauthorized actions.

bash

# Example Laravel policy enforcement to add inside editComment/doDeleteComment
# in app/Filament/Resources/TicketResource/Pages/ViewTicket.php

$comment = Comment::findOrFail($commentId);
abort_unless($comment->user_id === auth()->id(), 403, 'Not authorized');