Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields

中 6.5CVE-2026-48067 · GHSA-7q3w-xqjw-g3cr · 22/06/2026 公開 · 25/10/2026 更新

要点

CVE-2026-48067 は filament/actions, filament/tables に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.30%（全脆弱性の 22.8% より高い）。
対処：4.11.4, 5.6.4, 3.3.51 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
filament/actions Packagist	`≥ 4.0.0, < 4.11.4≥ 5.0.0, < 5.6.4`	`4.11.45.6.4`
filament/tables Packagist	`≥ 3.0.0, < 3.3.51`	`3.3.51`

概要

The recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value.

NVD の説明

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery() method may be used to scope the options available in the Select field for AttachAction and AssociateAction. However, the built-in validation rule for these fields did not apply the same scope. As a result, a user who can trigger these actions could tamper with the Livewire component's state and submit an out-of-scope value. This vulnerability is fixed in filament/actions 4.11.4 and 5.6.4 and filament/tables 3.3.51.