{"id":"ghsa-ghsa-mhf7-xp6r-6qrc","seq":661330,"kind":"advisory","title":"Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order","url":"https://github.com/advisories/GHSA-mhf7-xp6r-6qrc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mhf7-xp6r-6qrc","summary":"影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8\nThree issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {\"1\": 2, \"0\": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…","severity":"medium","techs":["php"],"cves":[],"tags":["GHSA-mhf7-xp6r-6qrc","livewire/livewire"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:51:30.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}