Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8

Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…

Read on GitHub Advisory Database

On 10/24/2026, 05:51 AM, GitHub Advisory Database published "Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order" (type: Advisory). Severity is "Medium" (medium). Related technologies: PHP.