# GHSA-mhf7-xp6r-6qrc: Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026

## What is GHSA-mhf7-xp6r-6qrc?

GHSA-mhf7-xp6r-6qrc is a vulnerability in livewire/livewire, published on 23 Oct 2026. 

### Official description

### Impact

Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:

1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{"1": 2, "0": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.
2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call.
3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.

Only applications using the `#[Authorize]` attribute are affected: on methods that take model parameters (issues 1 and 2), or on `#[Json]` methods (issue 3). Authorization performed inside the method (e.g. `$this->authorize(...)`) is not affected. Livewire 3.x is not affected.

### Patches

Fixed in **v4.4.8**. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and `#[Json]` methods are authorized before they run.

### Workarounds

Upgrade to v4.4.8. If you can't upgrade right away, call `$this->authorize(...)` inside affected methods instead of relying on the `#[Authorize]` attribute.

### Credits

Reported by Yousef Aman ([@yousef-aman](https://github.com/yousef-aman)).

## Which versions are affected by GHSA-mhf7-xp6r-6qrc?

2 open source packages ship an affected version, including livewire/livewire.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `livewire/livewire` | Packagist | From 4.3.0 | 4.4.8 |
| `livewire/livewire` | Packagist | From 4.3.0 | 4.4.8 |

## How do I fix GHSA-mhf7-xp6r-6qrc?

Upgrade livewire/livewire to 4.4.8 or later.

## Is GHSA-mhf7-xp6r-6qrc being exploited?

There is no known exploitation of GHSA-mhf7-xp6r-6qrc in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-mhf7-xp6r-6qrc and fix it if it is affected.

What it is: GHSA-mhf7-xp6r-6qrc is a vulnerability in livewire/livewire, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-mhf7-xp6r-6qrc in the wild and no public exploit code.

Affected packages and fixed versions:
- livewire/livewire (Packagist): affected from 4.3.0; fixed in 4.4.8
- livewire/livewire (Packagist): affected from 4.3.0; fixed in 4.4.8

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/ (Markdown: https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-mhf7-xp6r-6qrc

---
From sbomify Insights: https://insights.sbomify.com/GHSA-mhf7-xp6r-6qrc/
Summaries are generated and may contain mistakes; the official description above is the record.