ghsa:GHSA-MHF7-XP6R-6QRC: livewire/livewire >= 4.3.0, < 4.4.8

Affected technology

livewire/livewire · >= 4.3.0, < 4.4.8
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user could delete another user's comment. 2. **The same issue on event listeners.** Methods using both `#[On]` and `#[Authorize]` with a model parameter were affected in the same way through the `__dispatch` call. 3. **`#[Json]` methods ran before authorization.** When a method had both `#[Json]` and `#[Authorize]`, the method body executed before the authorization check. Source advisory’s CVSS 3.1 assessment rates confidentiality and availability impact as none; integrity impact as high.