Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

影響: composer:livewire/livewire >= 4.3.0, < 4.4.8 → 4.4.8

Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for: 1. Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('d…

在 GitHub Advisory Database 阅读

2026/10/24 05:51，GitHub Advisory Database 发布了“Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：PHP。