CVE-2026-48067: Filament Actions and Tables authorization bypass in record selection

CVE-2026-48067 · Severity: medium · CVSS 6.5 · Published 2026-06-22

Filament is a popular set of components used by developers to build administrative interfaces for Laravel web applications. A security flaw was found where certain data selection tools (AttachAction and AssociateAction) did not properly verify that a user's selection was within the allowed list of options. This could allow a logged-in user to bypass intended restrictions and link records or data they are not authorized to access, potentially compromising the integrity of the application's database.

Technologies: filament/tables (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-48067 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48067 being exploited in the wild.
How severe is CVE-2026-48067?
Medium severity, with a CVSS score of 6.5, published 22 June 2026.
Which products and versions are affected?
filament/actions (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.4; filament/tables (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.3.51.
Is there a fix for CVE-2026-48067?
Yes. filament/actions (Packagist): upgrade to 4.11.4 or later; filament/tables (Packagist): upgrade to 3.3.51 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48067 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48067?
Check whether you run filament/actions (Packagist) or filament/tables (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • filament/actions (Packagist): upgrade to 4.11.4 or later
    composer require filament/actions:^4.11.4
  • filament/tables (Packagist): upgrade to 3.3.51 or later
    composer require filament/tables:^3.3.51

Technical details

An authorization bypass (CWE-639) exists in Filament's AttachAction and AssociateAction components. While developers can use the recordSelectOptionsQuery() method to restrict which records a user can select in the UI, the corresponding server-side validation rule failed to enforce this same scope. An attacker with low privileges can intercept and modify the Livewire component's state to submit an ID for a record that should be out-of-scope. This allows for unauthorized association or attachment of records. The issue is resolved in filament/actions versions 4.11.4 and 5.6.4, and filament/tables version 3.3.51.

Affected products

  • filamentphp filament/actions >= 4.0.0, < 4.11.4; >= 5.0.0, < 5.6.4
  • filamentphp filament/tables >= 3.0.0, < 3.3.51

Identifiers

  • CVE-2026-48067
  • GHSA-7q3w-xqjw-g3cr

Timeline

  • 2026-05-23: advisory: Original GitHub security advisory published
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.