# Laravel Livewire authorization bypass via reordered parameters and #[Json] execution order

Source: https://junglewise.ai/threats/livewire-authorization-bypass-in-authorize-via-reordered-parameter-keys-033fc9d0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-10-23

Laravel Livewire is a framework for building interactive web applications with real-time updates. The #[Authorize] attribute failed to properly validate user permissions in three scenarios: when request parameters were reordered as an object, when used on event listeners, or when combined with #[Json] methods. An attacker could delete or modify records belonging to other users, or trigger unauthorized database operations.

Technologies: [Laravel Livewire](https://junglewise.ai/threats/technologies/livewire), [livewire/livewire (Packagist)](https://junglewise.ai/threats/technologies/livewire-livewire). Vendors: [Laravel](https://junglewise.ai/threats/vendors/laravel), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 23 October 2026.

**Which products and versions are affected?** Laravel Livewire 4.x before 4.4.8; livewire/livewire (Packagist) >= 4.3.0, < 4.4.8, ECOSYSTEM:introduced=4.3.0,fixed=4.4.8.

**Is there a fix for This vulnerability?** Yes. livewire/livewire (Packagist): upgrade to 4.4.8 or later. Until then: Until upgrading to v4.4.8, replace reliance on the #[Authorize] attribute with explicit authorization checks inside affected methods using $this->authorize(...). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Laravel Livewire or livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- livewire/livewire (Packagist): upgrade to 4.4.8 or later

  ```sh
  composer require livewire/livewire:^4.4.8
  ```


Until upgrading to v4.4.8, replace reliance on the #[Authorize] attribute with explicit authorization checks inside affected methods using $this->authorize(...).

## Technical details

The vulnerability involves three distinct authorization bypass flaws in Livewire 4.x: (1) the #[Authorize] attribute resolved model parameters by array key while actions received them positionally, allowing reordered integer keys to bypass checks; (2) the same parameter reordering issue existed for #[On] listeners; and (3) #[Json] methods executed their body before authorization checks, causing unintended side effects despite eventually returning 403. All require the application to use the #[Authorize] attribute on methods with model parameters or #[Json] decorators; manual authorization calls are unaffected.

## Affected products

- Laravel Livewire 4.x before 4.4.8

## Timeline

- 2026-10-23: advisory

## Related threats

- [Livewire DOM-based cross-site scripting in client-side state handling](https://junglewise.ai/threats/cve-2026-81887-livewire-dom-based-cross-site-scripting-in-client-side-state)
- [Livewire is vulnerable to remote command execution during component property update hydration](https://junglewise.ai/threats/cve-2025-54068-laravel-livewire-code-injection-in-component-hydration)
- [Livewire Remote Code Execution on File Uploads](https://junglewise.ai/threats/cve-2024-47823-livewire-remote-code-execution-on-file-uploads)
- [Data Leakage Vulnerability in livewire/livewire](https://junglewise.ai/threats/data-leakage-vulnerability-in-livewire-livewire-b4e3a064)
- [Cross-site Scripting in livewire/livewire](https://junglewise.ai/threats/cve-2024-21504-cross-site-scripting-in-livewire-livewire)