Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filament/tables | composer | >= 3.0.0, <= 3.3.50 | 3.3.51 |
| filament/actions | composer | >= 4.0.0, <= 4.11.3 | 4.11.4 |
| filament/actions | composer | >= 5.0.0, <= 5.6.3 | 5.6.4 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-7q3w-xqjw-g3cr, stems from an inconsistent application of authorization scopes in Filament's AssociateAction and AttachAction components. While developers could use the recordSelectOptionsQuery() method to filter the options presented to a user in a dropdown (Select field), the backend validation logic did not apply the same filter when processing the submitted selection.
The analysis of the patch commit fc47793e60cfa29e1b41c2c30564e072f9aef0d8 reveals that the setUp() methods in both AssociateAction.php and AttachAction.php were modified. These methods are responsible for handling the logic after a user submits the action form. Before the patch, these methods would find the record to associate/attach using the user-provided recordId without reapplying the scoping query. This created a security flaw where a malicious user could tamper with the Livewire component's state in their browser, submitting a recordId that was not in the original, scoped list of options, and the backend would improperly process it.
The patch rectifies this by ensuring that the custom query scope, if defined via modifyRecordSelectOptionsQueryUsing, is applied to the database query within the setUp() method itself. This guarantees that the validation step respects the same authorization rules as the data presentation layer. Therefore, the setUp() methods of these two actions are the precise locations of the vulnerability and would be the key functions observed in a runtime profile during an exploitation attempt.
Filament\Tables\Actions\AssociateAction::setUppackages/tables/src/Actions/AssociateAction.php
Filament\Tables\Actions\AttachAction::setUppackages/tables/src/Actions/AttachAction.php