CVE-2026-114508 in Laravel
Summary
by MITRE • 10/21/2026
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within the Laravel web application framework represents a critical failure in access control logic regarding database relationship handling. Specifically affecting versions from 12.45.0 up to but not including 12.68.0, and version 13.27.0 of the framework, this flaw allows an attacker with read-only permissions on specific endpoints to execute destructive operations against related database tables. The core technical issue stems from how Laravel processes relationship inclusion requests when interacting with API or web routes designated as read-only. In a properly secured system, any endpoint explicitly marked for reading data should strictly enforce retrieval queries that do not modify the underlying state of the database. However, in these vulnerable versions, the framework fails to distinguish between a request intended solely for fetching associated records and one that inadvertently triggers write operations on those related tables due to improper validation or execution logic within the relationship loading mechanism.
This architectural flaw enables an attacker who possesses only read access credentials to bypass permission boundaries effectively. By crafting specific requests that exploit the relationship inclusion feature, the application executes database commands such as deletes or updates against foreign key relationships rather than performing simple selects. This behavior violates the principle of least privilege and results in severe operational impacts including irreversible data loss, denial of service conditions due to emptying critical tables, and a complete compromise of data integrity within the affected system. The severity is heightened because standard authentication mechanisms may correctly identify the user as read-only, yet the application logic fails to enforce this restriction at the database interaction layer for related entities.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-787 Out-of-bounds Write if interpreted broadly as unauthorized state modification, though it is more accurately described under CWE-862 Missing Authorization where the application fails to enforce required access control checks for specific resources. In terms of adversary tactics, this exploitation vector corresponds to MITRE ATT&CK technique T1048 Exploitation for Data Exfiltration or potentially T1565 Stored Data Manipulation if the goal is data destruction rather than theft. The attack pattern involves manipulating input parameters related to relationship loading structures to trigger unintended side effects in the backend database engine, bypassing frontend and middleware level permission checks that typically govern user roles.
Mitigation strategies require immediate upgrading of the Laravel framework to version 12.68.0 or higher for the 12.x branch, and version 13.27.0 or higher for the 13.x branch where these logic errors have been corrected by the development team. For organizations unable to upgrade immediately due to dependency constraints, implementing strict input validation on all relationship inclusion parameters is essential. Developers should audit codebases that utilize eager loading of relationships via API endpoints and ensure that any endpoint marked as read-only explicitly disables write operations at the model level or uses database views that restrict modification capabilities. Additionally, employing a Web Application Firewall with rulesets designed to detect anomalous SQL patterns related to bulk deletes on relationship tables can provide an additional layer of defense against exploitation attempts targeting this specific vulnerability class until patches are applied.