Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8

Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…

GitHub Advisory Databaseで読む

2026/10/24 05:51、GitHub Advisory Databaseが「Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: PHP。