Authorization bypass: replyAction() in Comment Livewire component bypasses item visibility

Summary

The replyAction() method in app/Livewire/Item/Comment.php (line 82) uses Item::findOrFail($itemId) without the visibleForCurrentUser() scope, allowing any authenticated user to reply to comments on private items in private projects.

Inconsistency (1-of-N Pattern)

Every other item access point in the codebase correctly applies the visibleForCurrentUser() scope:

• ItemController line 24: Item::query()->visibleForCurrentUser()->where('slug', ...)->firstOrFail()
• ItemController line 136: $project->items()->visibleForCurrentUser()->findOrFail($itemId)
• Header.php, SpotlightSearch.php, BoardColumn.php, RecentItems.php all use ->visibleForCurrentUser()
• editAction() in the same file (line 56) properly scopes: auth()->user()->comments()->findOrFail($commentId)

Only replyAction() skips visibility enforcement.

Vulnerable Code

// Comment.php line 76-92
->action(function (array $data, array $arguments): void {
    $commentData = $arguments['comment'];
    $commentId = is_array($commentData) ? $commentData['id'] : $commentData->id;
    $itemId = is_array($commentData) ? $commentData['item_id'] : $commentData->item_id;

    $item = Item::findOrFail($itemId);  // No visibility check
    $comment = $item->comments()->findOrFail($commentId);

    $item->comments()->create([
        'parent_id' => $comment->id,
        'user_id' => auth()->id(),
        'content' => $data['content']
    ]);
    // ...
});

Impact

• Any authenticated user can reply to comments on private items (items with private = true)
• Any authenticated user can reply to comments on items in private projects
• The $itemId comes from client-side $arguments['comment'] data, which Livewire passes from the browser

Suggested Fix

$item = Item::query()->visibleForCurrentUser()->findOrFail($itemId);

This applies the same visibility filtering used everywhere else in the codebase.

Start in app/Livewire/Item/Comment.php at replyAction() and compare its item lookup with the visibleForCurrentUser() usage in ItemController and the other listed components. Done means replies to private items and private-project items are rejected for users who cannot view them, while authorized replies continue to work.