{"id":"CVE-2026-114508","kind":"vulnerability","aliases":["CVE-2026-114508","GHSA-5wcm-3v2w-8362"],"related":[],"title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.","summary":"Laravel framework versions 12.45.0 to before 12.68.0 and 13.0.0 to before 13.27.0 can run a destructive database operation on a related table when relationship inclusion is processed on certain read endpoints. An attacker with only read access can cause data loss, such as a related table being emptied.","severity":"medium","cvss":6.5,"epss":0.00306,"exploited":false,"exploited_at":null,"products":[{"name":"laravel/framework","fixed":["12.68.0"],"affected":">= 12.45.0, < 12.68.0","ecosystem":"composer"},{"name":"laravel/framework","fixed":["13.27.0"],"affected":">= 13.0.0, < 13.27.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","cwe-470","laravel","package","php"],"not_affected_if":["version-12.68.0-or-later","version-13.27.0-or-later","version-below-12.45.0"],"how_to_check":null,"fix":"Upgrade laravel/framework to 12.68.0 or 13.27.0 (whichever matches your major version).","status":"open","published_at":"2026-10-21T22:16:49+00:00","first_seen_at":"2026-10-23T21:51:54+00:00","triaged_at":"2026-10-23T21:52:58+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:52:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade laravel/framework to 12.68.0 or 13.27.0 (whichever matches your major version).","reach":"internet","impact":"high","summary":"Laravel framework versions 12.45.0 to before 12.68.0 and 13.0.0 to before 13.27.0 can run a destructive database operation on a related table when relationship inclusion is processed on certain read endpoints. An attacker with only read access can cause data loss, such as a related table being emptied.","category":"package","who_cares":["laravel","php","composer"],"confidence":0.6,"needs_auth":"yes","worst_case":"Read-only user empties a related database table, causing data loss and denial of service.","analyst_note":"Sources do not say which endpoint patterns or relationship configurations trigger the flaw; check the GHSA advisory at https://github.com/advisories/GHSA-5wcm-3v2w-8362 for the exact conditions to build a how_to_check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-below-12.45.0","version-12.68.0-or-later","version-13.27.0-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000505,"input_tokens":2926,"output_tokens":425,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114508':11A,19A '-2026':10A,18A '-470':24B '12.45.0':31B '12.68.0':34B '13.0.0':36B '13.27.0':39B '3v2w':15A '5wcm':14A '8362':16A 'access':64B,123C 'affect':153C 'applic':154C 'attack':60B 'caus':66B,125C 'certain':56B,85C 'compos':22B 'condit':90C 'could':124C,141C 'craft':101C 'cve':9A,17A 'cwe':23B 'data':7A,67B,116C,127C,150C 'databas':44B,106C 'denial':144C 'destruct':8A,43B,105C 'e.g':129C 'empti':75B,134C 'endpoint':58B,87C,98C 'framework':29B 'ghsa':13A 'ghsa-5wcm-3v2w':12A 'impact':117C 'inclus':3A,52B,81C 'integr':151C 'irrevers':126C 'laravel':1A,25B,28B 'laravel/framework':20A,21A 'loss':68B,128C,148C 'need':136C 'oper':45B,107C 'packag':26B 'permiss':139C 'php':27B 'process':54B,83C 'rather':112C 'read':57B,63B,86C,96C,122C 'read-on':95C 'relat':48B,72B,110C,131C 'relationship':2A,51B,80C 'request':92C 'result':142C 'retriev':115C 'run':41B 'servic':146C 'simpli':114C 'specif':89C 'tabl':49B,73B,111C,132C 'trigger':5A,103C 'unauthor':6A 'user':119C 'version':30B 'vulner':77C 'without':135C 'write':138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-5wcm-3v2w-8362","url":"https://github.com/advisories/GHSA-5wcm-3v2w-8362","severity":"medium","published_at":"2026-10-23T21:47:48+00:00","modified_at":"2026-10-23T21:47:49+00:00","first_seen_at":"2026-10-23T21:51:54+00:00","fetched_at":"2026-10-23T21:51:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114508","severity":null,"published_at":"2026-10-21T22:16:49+00:00","modified_at":"2026-10-23T22:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}