CVE-2026-48067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48067", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:25:25.707Z", "datePublished": "2026-06-22T21:46:27.323Z", "dateUpdated": "2026-06-23T14:29:20.932Z"}, "containers": {"cna": {"title": "Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr"}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"version": ">= 4.0.0, < 4.11.4", "status": "affected"}, {"version": ">= 5.0.0, < 5.6.4", "status": "affected"}, {"version": ">= 3.0.0, < 3.3.51", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-22T21:46:27.323Z"}, "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51."}], "source": {"advisory": "GHSA-7q3w-xqjw-g3cr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T14:29:10.944113Z", "id": "CVE-2026-48067", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T14:29:20.932Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T14:29:10.944113Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T14:29:16.432Z"}}], "cna": {"title": "Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields", "source": {"advisory": "GHSA-7q3w-xqjw-g3cr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.11.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.6.4"}, {"status": "affected", "version": ">= 3.0.0, < 3.3.51"}]}], "references": [{"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr", "name": "https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-22T21:46:27.323Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48067", "state": "PUBLISHED", "dateUpdated": "2026-06-23T14:29:20.932Z", "dateReserved": "2026-05-20T18:25:25.707Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-22T21:46:27.323Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "filament", "vendor": "filamentphp", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.11.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.6.4"}, {"status": "affected", "version": ">= 3.0.0, < 3.3.51"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo acelerado de Laravel. Desde filament/actions 4.0.0 hasta 4.11.4 y 5.6.4 y desde filament/tables 3.0.0 hasta 3.3.51, el m\u00e9todo recordSelectOptionsQuery() puede usarse para limitar el alcance de las opciones disponibles en el campo Select para AttachAction y AssociateAction. Sin embargo, la regla de validaci\u00f3n incorporada para estos campos no aplicaba el mismo alcance. Como resultado, un usuario que puede activar estas acciones podr\u00eda manipular el estado del componente Livewire y enviar un valor fuera de alcance. Esta vulnerabilidad est\u00e1 corregida en filament/actions 4.11.4 y 5.6.4 y filament/tables 3.3.51."}], "id": "CVE-2026-48067", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48067", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T14:29:10.944113Z", "version": "2.0.3"}}]}, "published": "2026-06-22T22:16:46.480", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.11.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.6.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.51)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "filament", "source": "cna", "vendor": "filamentphp"}, "product": "filament", "vendor": "filamentphp"}], "created": "2026-06-23T00:00:16.884367+00:00", "updated": "2026-06-23T01:15:16.322531+00:00", "vendors": ["filamentphp", "filamentphp$PRODUCT$filament"]}