{"id":"CVE-2026-114508","aliases":["GHSA-5wcm-3v2w-8362"],"url":"https://o3.security/vulnerability/CVE-2026-114508","summary":"Laravel relationship inclusion can trigger unauthorized data destruction","details":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.","published":"2026-10-21T21:45:31.465Z","modified":"2026-10-24T02:48:54.598234980Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"laravel/framework","fixedVersion":"12.68.0"},{"ecosystem":"Packagist","name":"laravel/framework","fixedVersion":"13.27.0"}],"fix":{"url":"https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e","label":"laravel/framework@50a7970"},"references":[{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v12.68.0"},{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v13.27.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114508.json"},{"type":"ADVISORY","url":"https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114508"},{"type":"FIX","url":"https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e"},{"type":"FIX","url":"https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8"},{"type":"FIX","url":"https://github.com/laravel/framework/pull/61322"},{"type":"FIX","url":"https://github.com/laravel/framework/pull/61323"},{"type":"PACKAGE","url":"https://github.com/laravel/framework"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:48:54.598234980Z"}}