CVE-2026-114508
- Source
- https://cve.org/CVERecord?id=CVE-2026-114508
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114508.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-114508
- Aliases
-
- GHSA-5wcm-3v2w-8362
- Published
- 2026-10-21T21:45:31Z
- Modified
- 2026-10-22T10:46:05Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
- Summary
- Laravel relationship inclusion can trigger unauthorized data destruction
- Details
-
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-470" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114508.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114508.json
- https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
- https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
- https://github.com/laravel/framework/pull/61322
- https://github.com/laravel/framework/pull/61323
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.27.0
- https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
- https://nvd.nist.gov/vuln/detail/CVE-2026-114508
Affected packages
Git / github.com/laravel/framework
Affected ranges
- Type
- GIT
- Repo
- https://github.com/laravel/framework
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "12.45.0" }, { "fixed": "12.68.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "13.0.0" }, { "fixed": "13.27.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "50a7970efe9f9990b6ec4f1e949de2abaaf4263e" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "b89f2944995d555bfda76dced1ef6c6b04ef17d8" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v12.68.0", "range": [ { "fixed": "1343c22b92edd48e29ff273d8ce7c15cf75d974c" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v13.27.0", "range": [ { "fixed": "f3fa8f3591fa2e8f0b7dedfffc3fc324d2aad31b" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v12.*
v12.45.0
v12.45.1
v12.45.2
v12.46.0
v12.47.0
v12.48.0
v12.48.1
v12.49.0
v12.50.0
v12.51.0
v12.52.0
v12.53.0
v12.54.0
v12.54.1
v12.55.0
v12.55.1
v12.56.0
v12.57.0
v12.58.0
v12.59.0
v12.60.0
v12.60.1
v12.60.2
v12.61.0
v12.61.1
v12.62.0
v12.63.0
v12.64.0
v12.65.0
v12.66.0
v12.67.0
v13.*
v13.0.0
v13.1.0
v13.1.1
v13.10.0
v13.11.0
v13.11.1
v13.11.2
v13.12.0
v13.13.0
v13.14.0
v13.15.0
v13.16.0
v13.16.1
v13.17.0
v13.18.0
v13.18.1
v13.19.0
v13.2.0
v13.20.0
v13.21.0
v13.21.1
v13.22.0
v13.23.0
v13.24.0
v13.25.0
v13.26.0
v13.26.1
v13.3.0
v13.4.0
v13.5.0
v13.6.0
v13.7.0
v13.8.0
v13.9.0