Executive brief
Filament is a popular set of components used by developers to build administrative interfaces for Laravel web applications. A security flaw was found where certain data selection tools (AttachAction and AssociateAction) did not properly verify that a user's selection was within the allowed list of options. This could allow a logged-in user to bypass intended restrictions and link records or data they are not authorized to access, potentially compromising the integrity of the application's database.
Technical details
An authorization bypass (CWE-639) exists in Filament's AttachAction and AssociateAction components. While developers can use the recordSelectOptionsQuery() method to restrict which records a user can select in the UI, the corresponding server-side validation rule failed to enforce this same scope. An attacker with low privileges can intercept and modify the Livewire component's state to submit an ID for a record that should be out-of-scope. This allows for unauthorized association or attachment of records. The issue is resolved in filament/actions versions 4.11.4 and 5.6.4, and filament/tables version 3.3.51.
Affected products
- filamentphp filament/actions >= 4.0.0, < 4.11.4; >= 5.0.0, < 5.6.4
- filamentphp filament/tables >= 3.0.0, < 3.3.51
Timeline
- 2026-05-23: advisory: Original GitHub security advisory published
- 2026-06-22: disclosed: CVE published to NVD