All vulnerabilities
CVE-2026-114508GHSA-5wcm-3v2w-8362

laravel/framework: Laravel relationship inclusion can trigger unauthorized data destruction

laravel laravel/frameworkcomposerFrameworks
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.68.0Also 13.27.0GitHub
Published21 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 12.68.0laravel/framework, composerGitHubcomposer require "laravel/framework:^12.68.0"
  • 13.27.0laravel/framework, composerGitHubcomposer require "laravel/framework:^13.27.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

Impact

A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

Text from GitHub Advisory Database

Affected versions 6

  • laravel/framework, composer>= 12.45.0, < 12.68.0GitHub
  • laravel/framework, composer>= 13.0.0, < 13.27.0GitHub
  • frameworkaffected: >= 12.45.0, < 12.68.0CVE List
  • frameworkaffected: >= 13.0.0, < 13.27.0CVE List
  • laravel/framework, composer>= 12.45.0GitHub
  • laravel/framework, composer< 13.27.0GitHub

References 9