{"answers":{"affected":"2 open source packages ship an affected version, including livewire/livewire.","exploited":"There is no known exploitation of GHSA-mhf7-xp6r-6qrc in the wild and no public exploit code.","fix":"Upgrade livewire/livewire to 4.4.8 or later.","what":"GHSA-mhf7-xp6r-6qrc is a vulnerability in livewire/livewire, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-mhf7-xp6r-6qrc and fix it if it is affected.\n\nWhat it is: GHSA-mhf7-xp6r-6qrc is a vulnerability in livewire/livewire, published on 23 Oct 2026. \nExploitation: There is no known exploitation of GHSA-mhf7-xp6r-6qrc in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- livewire/livewire (Packagist): affected from 4.3.0; fixed in 4.4.8\n- livewire/livewire (Packagist): affected from 4.3.0; fixed in 4.4.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/ (Markdown: https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/index.md)","id":"GHSA-mhf7-xp6r-6qrc","markdown":"https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/index.md","name":"GHSA-mhf7-xp6r-6qrc","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nThree issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:\n\n1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{\"1\": 2, \"0\": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.\n2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.\n3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.\n\nOnly applications using the `#[Authorize]` attribute are affected: on methods that take model parameters (issues 1 and 2), or on `#[Json]` methods (issue 3). Authorization performed inside the method (e.g. `$this-\u003eauthorize(...)`) is not affected. Livewire 3.x is not affected.\n\n### Patches\n\nFixed in **v4.4.8**. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and `#[Json]` methods are authorized before they run.\n\n### Workarounds\n\nUpgrade to v4.4.8. If you can't upgrade right away, call `$this-\u003eauthorize(...)` inside affected methods instead of relying on the `#[Authorize]` attribute.\n\n### Credits\n\nReported by Yousef Aman ([@yousef-aman](https://github.com/yousef-aman)).","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order","id":"GHSA-mhf7-xp6r-6qrc","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["4.4.8"],"introduced":["4.3.0"],"last_affected":[],"package":"livewire/livewire","purl":null,"source":"GHSA-mhf7-xp6r-6qrc"},{"ecosystem":"Packagist","fixed":["4.4.8"],"introduced":["4.3.0"],"last_affected":[],"package":"livewire/livewire","purl":"pkg:composer/livewire/livewire","source":"GHSA-mhf7-xp6r-6qrc"}],"products":null,"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/"}