CVE-2026-10284: DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization
A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component Livewire Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
app/Filament/Resources/TicketResource/Pages/ViewTicket.phpfrom your environment.If feasible, remove or comment out the doDeleteComment and editComment methods (or the Livewire handlers that expose them) to prevent remote invocation until a proper fix is released.
- Configuration
Temporarily disable or restrict the doDeleteComment and editComment Livewire handlers in app/Filament/Resources/TicketResource/Pages/ViewTicket.php (for example, remove the Livewire listeners, return early from the methods, or add strict authorization checks) until an upstream patch is available.
DevaslanPHP project-management (Livewire Handler - app/Filament/Resources/TicketResource/Pages/ViewTicket.php) doDeleteComment / editComment handling = disabled or restricted - Compensating control
Restrict access to the Filament/UI and any management endpoints (including the ticket view/delete comment actions) to trusted IPs, VPNs, or through a Web Application Firewall to block remote exploitation of the improper authorization.
- Operational
Audit recent comment edit/delete actions and application logs for unauthorized activity, restore or investigate any suspicious deletions, and monitor for attempts exploiting the Livewire ViewTicket doDeleteComment/editComment functionality until the issue is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10284?
The severity of CVE-2026-10284 is rated as medium with a score of 5.3.
What vulnerability does CVE-2026-10284 describe?
CVE-2026-10284 describes an improper authorization flaw in the doDeleteComment function of DevaslanPHP's ViewTicket.php file.
How can I mitigate the risks associated with CVE-2026-10284?
To mitigate CVE-2026-10284, ensure proper authorization checks are implemented for the comment deletion functionality.
Which versions of DevaslanPHP are affected by CVE-2026-10284?
CVE-2026-10284 affects the DevaslanPHP project-management tool up to version 2.0.0-beta1.
Is CVE-2026-10284 exploitable remotely?
Yes, CVE-2026-10284 has an attack vector that allows remote exploitation.