Live › vulnerability › CVE-2026-114508
Go to dashboardLaravel framework versions 12.45.0 to before 12.68.0 and 13.0.0 to before 13.27.0 can run a destructive database operation on a related table when relationship inclusion is processed on certain read endpoints. An attacker with only read access can cause data loss, such as a related table being emptied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:51 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| laravel/framework | composer | >= 12.45.0, < 12.68.0 | 12.68.0 |
| laravel/framework | composer | >= 13.0.0, < 13.27.0 | 13.27.0 |
Unknown from the sources.
Upgrade laravel/framework to 12.68.0 or 13.27.0 (whichever matches your major version).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
This page as .md · .json · in your agent: get_signal("CVE-2026-114508")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.