{"id":"CVE-2026-114508","revision":"b8eaf1eed069423b9378ecc11d175785","records":[{"revision":"b8eaf1eed069423b9378ecc11d175785","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-114508","aliases":[],"title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","state":0,"publishedAt":"2026-10-21T21:45:31.465+00:00","modifiedAt":"2026-10-21T21:45:31.465+00:00","affected":[{"ecosystem":"Vendor product","name":"framework","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"laravel\",\n                    \"product\": \"framework\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 12.45.0, < 12.68.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 13.0.0, < 13.27.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362","https://github.com/laravel/framework/pull/61322","https://github.com/laravel/framework/pull/61323","https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e","https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8","https://github.com/laravel/framework/releases/tag/v12.68.0","https://github.com/laravel/framework/releases/tag/v13.27.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114508","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114508","identifiers":["CVE-2026-114508"]},"retained":false,"historicalAffected":[]}],"coverage":[]}