CVE-2026-48067: Filament Auth Bypass Vulnerability

CVE-2026-48067 Overview

CVE-2026-48067 is an authorization bypass vulnerability in Filament, a collection of full-stack components for accelerated Laravel development. The flaw affects filament/actions versions 4.0.0 through 4.11.3 and 5.0.0 through 5.6.3, plus filament/tables versions 3.0.0 through 3.3.50. The recordSelectOptionsQuery() method scopes options available in the Select field for AttachAction and AssociateAction, but the built-in validation rule does not apply the same scope. An authenticated user with permission to trigger these actions can tamper with the Livewire component state and submit an out-of-scope value [CWE-639].

Critical Impact
Authenticated users can bypass record-scoping authorization checks to attach or associate records outside their permitted dataset, compromising data integrity.

Affected Products

filament/actions 4.0.0 through 4.11.3
filament/actions 5.0.0 through 5.6.3
filament/tables 3.0.0 through 3.3.50

Discovery Timeline

2026-06-22 - CVE-2026-48067 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48067

Vulnerability Analysis

The vulnerability resides in how Filament handles record selection within AttachAction and AssociateAction components. Developers use recordSelectOptionsQuery() to constrain which records appear as selectable options in the UI Select field. This method applies query scoping to filter records based on the current user context or business rules.

The validation layer for these form fields does not reuse the same scoped query. Filament instead validates the submitted value against a broader, unscoped record set. This inconsistency creates a server-side authorization gap that the client can exploit by manipulating Livewire component state.

Root Cause

The root cause is an authorization check failure classified under [CWE-639] Authorization Bypass Through User-Controlled Key. The recordSelectOptionsQuery() scope is enforced only at the presentation layer when populating select options. The submission validation does not re-apply the constraint, so the server trusts any record identifier that exists in the underlying table.

Attack Vector

An authenticated attacker who can legitimately access an AttachAction or AssociateAction modifies the Livewire component's wire state before submission. The attacker substitutes the legitimate record identifier with an identifier referencing a record outside the intended scope. The server-side validation accepts the value because it only checks record existence, not scope membership. The attach or associate operation completes against an unauthorized record, modifying relationships that the user should not control.

The vulnerability requires low privileges and network access without user interaction. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-48067

Indicators of Compromise

Livewire requests targeting AttachAction or AssociateAction endpoints containing record identifiers outside the expected scope for the authenticated user.
Unexpected attach or associate database operations in pivot tables referencing records the acting user should not access.
Application logs showing successful action submissions with recordId values that do not match the user's permitted dataset.

Detection Strategies

Audit pivot table writes and relationship changes against expected user-scope boundaries, flagging mismatches.
Add server-side logging that records the scoped query result and the submitted value for every AttachAction and AssociateAction invocation.
Compare Livewire payload recordId values against the result set returned by recordSelectOptionsQuery() and alert on divergence.

Monitoring Recommendations

Monitor Laravel application logs for anomalous spikes in attach or associate operations on sensitive relationships.
Track per-user rates of relationship modifications and alert on deviations from baseline.
Review application access logs for tampered Livewire state payloads, including direct manipulation of hidden form fields.

How to Mitigate CVE-2026-48067

Immediate Actions Required

Upgrade filament/actions to version 4.11.4 or 5.6.4, and filament/tables to version 3.3.51.
Inventory all custom AttachAction and AssociateAction usages that rely on recordSelectOptionsQuery() for authorization.
Review recent pivot table writes for unauthorized associations created prior to patching.

Patch Information

The vulnerability is fixed in filament/actions 4.11.4 and 5.6.4, and in filament/tables 3.3.51. The patched versions apply the same scope used in recordSelectOptionsQuery() to the validation rule, ensuring submitted values are validated against the scoped record set. Update via Composer using composer update filament/actions filament/tables. Refer to the GitHub Security Advisory GHSA-7q3w-xqjw-g3cr for full remediation details.

Workarounds

Add a custom validation rule on affected actions that re-applies the recordSelectOptionsQuery() scope and rejects out-of-scope identifiers.
Implement an authorize() check on the action that validates the submitted record belongs to the user's permitted dataset before persisting.
Restrict access to AttachAction and AssociateAction to trusted roles until patches are deployed.

bash

# Update Filament packages to patched versions
composer require filament/actions:^5.6.4
composer require filament/tables:^3.3.51
composer update filament/actions filament/tables