AIKIDO-2026-753993

awcodes/filament-curator is vulnerable to Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled KeyGHSA-c684-h96h-x6g9 Published 2 days ago

Medium Risk

This Affects:

awcodes/filament-curator

3.0.0 - 3.7.12

Fixed in 3.7.13

4.0.0 - 4.2.2

Fixed in 4.2.3

5.0.0 - 5.5.2

Fixed in 5.5.3

Are you affected? Scan for Free

TL;DR

The media picker's listing, directory navigation, search, and saved selection ids don't enforce the field's disk, type, directory, or tenant restrictions. A wildcard accepted type is matched with an ungrouped orWhere, returning images from every directory, disk, and tenant, and a saved media id is never re-checked against those restrictions before the form reloads it. Opening a picker is enough to reach this; no request tampering is needed. The fix resolves every selection through a single scope that re-applies the disk, type, directory, and tenant restrictions together.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

awcodes/filament-curator is vulnerable to Authorization Bypass Through User-Controlled Key in versions 3.0.0 - 3.7.12, 4.0.0 - 4.2.2 and 5.0.0 - 5.5.2.