Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Medium · CVSS 6.5 (GHSA) · fetched 2026-10-23
### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for: 1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{"1": 2, "0": 1}`) could pass authorization with a record the user owns while the action received a different record.
Remediation
Upgrade livewire/livewire to 4.4.8 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-23T18:20:12-04:00 · https://github.com/advisories/GHSA-mhf7-xp6r-6qrc