Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 23 October 2026.

Which products and versions are affected?

Laravel Livewire 4.x before 4.4.8; livewire/livewire (Packagist) >= 4.3.0, < 4.4.8, ECOSYSTEM:introduced=4.3.0,fixed=4.4.8.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Laravel Livewire or livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Laravel Livewire authorization bypass via reordered parameters and #[Json] execution order

Q: Is there a fix for This vulnerability?

Yes. livewire/livewire (Packagist): upgrade to 4.4.8 or later. Until then: Until upgrading to v4.4.8, replace reliance on the #[Authorize] attribute with explicit authorization checks inside affected methods using $this->authorize(...). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Severity: medium · CVSS 6.5 · Published 2026-10-23

Laravel Livewire is a framework for building interactive web applications with real-time updates. The #[Authorize] attribute failed to properly validate user permissions in three scenarios: when request parameters were reordered as an object, when used on event listeners, or when combined with #[Json] methods. An attacker could delete or modify records belonging to other users, or trigger unauthorized database operations.

Technologies: Laravel Livewire, livewire/livewire (Packagist). Vendors: Laravel, Packagist.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 23 October 2026.
Which products and versions are affected?: Laravel Livewire 4.x before 4.4.8; livewire/livewire (Packagist) >= 4.3.0, < 4.4.8, ECOSYSTEM:introduced=4.3.0,fixed=4.4.8.
Is there a fix for This vulnerability?: Yes. livewire/livewire (Packagist): upgrade to 4.4.8 or later. Until then: Until upgrading to v4.4.8, replace reliance on the #[Authorize] attribute with explicit authorization checks inside affected methods using $this->authorize(...). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Laravel Livewire or livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

livewire/livewire (Packagist): upgrade to 4.4.8 or later
```
composer require livewire/livewire:^4.4.8
```

Until upgrading to v4.4.8, replace reliance on the #[Authorize] attribute with explicit authorization checks inside affected methods using $this->authorize(...).

Technical details

The vulnerability involves three distinct authorization bypass flaws in Livewire 4.x: (1) the #[Authorize] attribute resolved model parameters by array key while actions received them positionally, allowing reordered integer keys to bypass checks; (2) the same parameter reordering issue existed for #[On] listeners; and (3) #[Json] methods executed their body before authorization checks, causing unintended side effects despite eventually returning 403. All require the application to use the #[Authorize] attribute on methods with model parameters or #[Json] decorators; manual authorization calls are unaffected.

Affected products

Laravel Livewire 4.x before 4.4.8

Timeline

2026-10-23: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.