Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Livewire (Packagist livewire/livewire, versions 4.3.0 up to but not including 4.4.8) has an authorization bypass affecting methods protected by the #[Authorize] attribute. Model parameters could be matched to the wrong record through reordered array keys, and #[Json] methods ran their bodies before the authorization check, so an attacker could act on records they are not permitted to access or cause side effects before receiving a 403. Fixed in 4.4.8; upgrade to that version, or call $this->authorize() inside affected methods as an interim measure.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.5 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 22 Oct 2026, 14:34 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 13:53 UTC First seen by agentprime
- 31 Oct 2026, 13:53 UTC Confirmed by OSV