# CVE-2026-48067: Filament Actions and Tables authorization bypass in record selection

Source: https://junglewise.ai/threats/cve-2026-48067-filament-actions-and-tables-authorization-bypass-in-record  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-48067 · Severity: medium · CVSS 6.5 · Published 2026-06-22

Filament is a popular set of components used by developers to build administrative interfaces for Laravel web applications. A security flaw was found where certain data selection tools (AttachAction and AssociateAction) did not properly verify that a user's selection was within the allowed list of options. This could allow a logged-in user to bypass intended restrictions and link records or data they are not authorized to access, potentially compromising the integrity of the application's database.

Technologies: [filament/tables (Packagist)](https://junglewise.ai/threats/technologies/filament-tables). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-48067 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48067 being exploited in the wild.

**How severe is CVE-2026-48067?** Medium severity, with a CVSS score of 6.5, published 22 June 2026.

**Which products and versions are affected?** filament/actions (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.4; filament/tables (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.3.51.

**Is there a fix for CVE-2026-48067?** Yes. filament/actions (Packagist): upgrade to 4.11.4 or later; filament/tables (Packagist): upgrade to 3.3.51 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48067 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48067?** Check whether you run filament/actions (Packagist) or filament/tables (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- filament/actions (Packagist): upgrade to 4.11.4 or later

  ```sh
  composer require filament/actions:^4.11.4
  ```

- filament/tables (Packagist): upgrade to 3.3.51 or later

  ```sh
  composer require filament/tables:^3.3.51
  ```


## Technical details

An authorization bypass (CWE-639) exists in Filament's AttachAction and AssociateAction components. While developers can use the recordSelectOptionsQuery() method to restrict which records a user can select in the UI, the corresponding server-side validation rule failed to enforce this same scope. An attacker with low privileges can intercept and modify the Livewire component's state to submit an ID for a record that should be out-of-scope. This allows for unauthorized association or attachment of records. The issue is resolved in filament/actions versions 4.11.4 and 5.6.4, and filament/tables version 3.3.51.

## Affected products

- filamentphp filament/actions >= 4.0.0, < 4.11.4; >= 5.0.0, < 5.6.4
- filamentphp filament/tables >= 3.0.0, < 3.3.51

## Identifiers

- CVE-2026-48067
- GHSA-7q3w-xqjw-g3cr

## Timeline

- 2026-05-23: advisory: Original GitHub security advisory published
- 2026-06-22: disclosed: CVE published to NVD

## References

- [https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr](https://github.com/filamentphp/filament/security/advisories/GHSA-7q3w-xqjw-g3cr)

## Related threats

- [Filament stored XSS in ImageColumn and ImageEntry components](https://junglewise.ai/threats/cve-2026-48167-filament-stored-xss-in-imagecolumn-and-imageentry-components)
- [Filament Tables stored XSS in Range and Values summarizers](https://junglewise.ai/threats/cve-2026-33080-filament-tables-stored-xss-in-range-and-values-summarizers)
- [Filament insecure default storage for exported files](https://junglewise.ai/threats/cve-2024-51758-filament-insecure-default-storage-for-exported-files)
- [Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting](https://junglewise.ai/threats/cve-2024-47186-filament-has-unvalidated-colorcolumn-and-colorentry-values-that)