Incorrect authorization in Livewire - #VU164371

Vulnerability details

The vulnerability allows a remote user to bypass authorization and modify or delete records without permission.

The vulnerability exists due to incorrect authorization in Livewire's #[Authorize] handling when resolving model parameters inconsistently with positional invocation or executing #[Json] methods before authorization checks. A remote user can submit reordered integer parameter keys such as {"1": 2, "0": 1} to actions or event listeners through __dispatch, or invoke methods combining #[Json] and #[Authorize], to perform unauthorized database writes or deletions.

Affected software

Remediation

External References

• https://github.com/livewire/livewire/security/advisories/GHSA-mhf7-xp6r-6qrc

Related Security Bulletins

• Incorrect authorization in Livewire