CVE-2026-48166

{
  "id": "CVE-2026-48166",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T22:16:46.750",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5."
    },
    {
      "lang": "es",
      "value": "Filament es una colección de componentes full-stack para el desarrollo acelerado de Laravel. Desde la versión 4.0.0 hasta la 4.11.5 y la 5.6.5, la página de inicio de sesión presenta una discrepancia de tiempo observable que permite a atacantes no autenticados enumerar direcciones de correo electrónico registradas. El impacto se limita a revelar si existe una cuenta para un correo electrónico dado. Esta vulnerabilidad está corregida en las versiones 4.11.5 y 5.6.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "filamentphp",
          "product": "filament",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.11.5",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.6.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T12:28:19.870932Z",
          "id": "CVE-2026-48166",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f",
      "source": "[email protected]"
    }
  ]
}