Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8
Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…
| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 05:51, GitHub Advisory Database에서 "Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: PHP.