## Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

- 種別: advisory
- 重大度: medium
- 関連技術: php
- 公開日時: 2026-10-23T20:51:30.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-mhf7-xp6r-6qrc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-mhf7-xp6r-6qrc

影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8
Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…