CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Authenticated attackers can modify app-based MFA settings without password reauthentication, potentially locking out legitimate users or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104181?
CVE-2026-104181 is a medium-severity missing authorization vulnerability in filamentphp filament, published on 1 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.
Weakness: CWE-306
Which versions are affected by CVE-2026-104181?
4 open source packages ship an affected version, including filament/filament.
| Package | Affected | Fixed in |
|---|---|---|
filament/filament Packagist | From 4.0.0 | 4.13.3 |
filament/filament Packagist | From 4.0.0 | 4.13.3 |
filament/filament Packagist | From 5.0.0 | 5.8.3 |
filament/filament Packagist | From 5.0.0 | 5.8.3 |
How do I fix CVE-2026-104181?
Upgrade filament/filament to a fixed version for your release line: 4.13.3 or 5.8.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104181 being exploited?
There is no known exploitation of CVE-2026-104181 in the wild and no public exploit code.
Sources
Also known as GHSA-7m6h-rg42-m449.