CVE-2026-118510
Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
MongoDB Laravel MongoDBFrameworksCVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.12.0Laravel MongoDBCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
Text from CVE List
Affected versions 1
- Laravel MongoDBaffected: 3.2.3 before 5.12.0CVE List