Skip to content

v4.1.3

Choose a tag to compare

View all tags
@awcodes awcodes released this 25 Jul 16:08
v4.1.3
dd29667

Security

Fixes a broken access control vulnerability (CWE-862 / CWE-639, CVSS 7.6 High): the media picker modal's per-item Edit, Delete, and Download actions resolved their target Media record from client-supplied input without a per-record authorization check or tenant scoping. Any authenticated user able to reach a form containing a CuratorPicker field could edit, delete, or download arbitrary Media records by id — bypassing any MediaPolicy the host app defines and Curator's own multi-tenancy scoping. The Download action also streamed a client-supplied disk/path directly.

These actions now enforce the resource's authorization policy per-record and apply the same tenant scoping used elsewhere in the picker, and Download streams from the stored record instead of the request payload. No configuration changes are required after upgrading.

See the security advisory for full details:
https://github.com/awcodes/filament-curator/security/advisories/GHSA-3m5g-3j68-ghvp

Assets 2
Loading