AIKIDO-2026-878390

awcodes/filament-curator is vulnerable to Broken Access Control

Broken Access ControlGHSA-3m5g-3j68-ghvp Published 3 days ago

High Risk

This Affects:

awcodes/filament-curator

0.0.1 - 3.7.9

Fixed in 3.7.10

4.0.0 - 4.1.2

Fixed in 4.1.3

5.0.0 - 5.1.2

Fixed in 5.1.3

Are you affected? Scan for Free

TL;DR

The media picker modal in Curator exposes per-item Edit, Delete, and Download actions that resolve their target Media record from client-supplied identifiers in the action arguments and selected state. These actions run without a per-record authorization check or tenant scoping, so an authenticated user who can reach a form embedding the picker can edit, delete, or download any Media record by id, including records owned by other tenants, and the Download action streams a file from a client-supplied disk and path. Media policies defined by the host application were never consulted on these code paths. The fix routes all three actions through a shared helper that applies the picker's tenant scoping and a per-record policy check before acting, and derives the download disk and path from the authorized record instead of the request payload.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you expose a form containing a Curator picker field to authenticated users.