{"id":"GHSA-mhf7-xp6r-6qrc","kind":"vulnerability","aliases":["GHSA-mhf7-xp6r-6qrc"],"related":[],"title":"Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order","description":"### Impact\n\nThree issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:\n\n1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{\"1\": 2, \"0\": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.\n2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.\n3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.\n\nOnly applications using the `#[Authorize]` attribute are affected: on methods that take model parameters (issues 1 and 2), or on `#[Json]` methods (issue 3). Authorization performed inside the method (e.g. `$this->authorize(...)`) is not affected. Livewire 3.x is not affected.\n\n### Patches\n\nFixed in **v4.4.8**. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and `#[Json]` methods are authorized before they run.\n\n### Workarounds\n\nUpgrade to v4.4.8. If you can't upgrade right away, call `$this->authorize(...)` inside affected methods instead of relying on the `#[Authorize]` attribute.\n\n### Credits\n\nReported by Yousef Aman ([@yousef-aman](https://github.com/yousef-aman)).","summary":"Livewire's #[Authorize] attribute checked the wrong record when request parameters were sent with reordered keys, and #[Json] methods ran their body before the authorization check. An authenticated user can make a Livewire action operate on a record they do not own, such as deleting another user's comment, and side effects of #[Json] methods happen even when the response is a 403.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"livewire/livewire","fixed":["4.4.8"],"affected":">= 4.3.0, < 4.4.8","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["cwe-863","laravel","livewire","package","php"],"not_affected_if":["authorize-inside-method","livewire-3","no-authorize-attribute"],"how_to_check":"Run: composer show livewire/livewire and confirm the version is >= 4.3.0 and < 4.4.8.\nSearch app code for '#[Authorize' on methods that take model parameters or on #[Json] methods.","fix":"Upgrade livewire/livewire to 4.4.8 or later.\nIf you cannot upgrade, call $this->authorize(...) inside affected methods instead of relying on #[Authorize].","status":"open","published_at":"2026-10-23T20:51:30+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:20+00:00","updated_at":"2026-10-23T21:00:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:00:20Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade livewire/livewire to 4.4.8 or later.\nIf you cannot upgrade, call $this->authorize(...) inside affected methods instead of relying on #[Authorize].","reach":"internet","impact":"medium","summary":"Livewire's #[Authorize] attribute checked the wrong record when request parameters were sent with reordered keys, and #[Json] methods ran their body before the authorization check. An authenticated user can make a Livewire action operate on a record they do not own, such as deleting another user's comment, and side effects of #[Json] methods happen even when the response is a 403.","category":"package","who_cares":["livewire","laravel","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user modifies or deletes records owned by other users","analyst_note":"","how_to_check":"Run: composer show livewire/livewire and confirm the version is >= 4.3.0 and < 4.4.8.\nSearch app code for '#[Authorize' on methods that take model parameters or on #[Json] methods.\nunknown","needs_analyst":false,"not_affected_if":["livewire-3","no-authorize-attribute","authorize-inside-method"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3385,"output_tokens":448,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-863':26B '/yousef-aman)).':360C '0':154C '1':115C,152C,155C,269C '2':153C,188C,271C '3':215C,277C,290C '403':93B,242C '6qrc':18A,23A 'action':64B,98C,123C,135C,167C 'affect':206C,261C,288C,294C,341C 'allow':97C 'alreadi':252C 'aman':354C,357C 'anoth':76B,184C 'applic':255C 'array':131C 'attribut':34B,103C,259C,349C 'authent':58B 'author':2A,5A,33B,55B,102C,113C,124C,158C,173C,200C,220C,228C,235C,258C,278C,285C,322C,339C,348C 'away':336C 'bodi':52B,231C 'bypass':3A 'call':214C,299C,337C 'check':35B,56B,236C 'comment':79B,175C,178C,179C,187C 'could':156C,182C 'credit':350C 'current':109C 'cwe':25B 'databas':249C 'delet':75B,174C,183C 'deletecom':177C 'differ':170C 'dispatch':213C 'e.g':151C,283C 'effect':82B,246C 'even':87B 'event':193C,301C 'execut':12A,232C 'fix':296C 'ghsa':15A,20A 'ghsa-mhf7-xp6r-6qrc':14A,19A 'github.com':359C 'github.com/yousef-aman)).':358C 'happen':86B,253C 'impact':94C 'insid':280C,340C 'instead':343C 'integ':149C 'issu':96C,191C,268C,276C 'json':11A,48B,84B,216C,226C,274C,319C 'key':9A,46B,121C,132C,150C,312C 'laravel':27B 'list':307C 'listen':194C 'livewir':1A,28B,31B,63B,289C 'livewire/livewire':24A 'make':61B 'method':49B,85B,195C,217C,223C,230C,263C,275C,282C,320C,342C 'mhf7':16A,21A 'model':127C,203C,266C 'must':303C 'name':310C 'object':146C 'oper':65B 'order':13A,119C 'otherwis':313C 'out-of-ord':116C 'own':164C 'packag':29B 'param':143C 'paramet':8A,41B,120C,128C,138C,204C,267C,302C 'pass':157C 'patch':295C 'perform':279C 'php':30B 'posit':139C 'protect':99C 'ran':50B,218C 'receiv':137C,168C 'record':38B,68B,107C,161C,171C 'reject':317C 'reli':345C 'reorder':7A,45B,148C 'report':351C 'request':40B,141C,315C 'resolv':125C 'respons':90B,238C 'right':335C 'run':105C,325C 'send':142C 'sent':43B 'side':81B,245C 'still':240C 'string':311C 'take':265C 'three':95C 'upgrad':327C,334C 'use':196C,256C,309C 'user':59B,77B,110C,163C,181C,185C 'v4.4.8':298C,329C 'via':6A 'way':210C 'workaround':326C 'write':250C 'wrong':37B 'x':291C 'xp6r':17A,22A 'yousef':353C,356C 'yousef-aman':355C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T20:51:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mhf7-xp6r-6qrc","url":"https://github.com/advisories/GHSA-mhf7-xp6r-6qrc","severity":"medium","published_at":"2026-10-23T20:51:30+00:00","modified_at":"2026-10-23T20:51:30+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}