p PatchFirst

CVE-2026-114508

CVE-2026-114508 · Laravel relationship inclusion can trigger unauthorized data destruction

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • framework

    Versions
    • >= 12.45.0, < 12.68.0: Affected
    • >= 13.0.0, < 13.27.0: Affected

    No fix published

  • laravel/framework Packagist

    Versions
    • v12.45.0
    • v12.45.1
    • v12.45.2
    • v12.46.0
    • v12.47.0
    • v12.48.0
    • v12.48.1
    • v12.49.0
    • v12.50.0
    • v12.51.0
    • v12.52.0
    • v12.53.0
    • v12.54.0
    • v12.54.1
    • v12.55.0
    • v12.55.1
    • v12.56.0
    • v12.57.0
    • v12.58.0
    • v12.59.0
    • v12.60.0
    • v12.60.1
    • v12.60.2
    • v12.61.0
    • v12.61.1
    • v12.62.0
    • v12.63.0
    • v12.64.0
    • v12.65.0
    • v12.66.0
    • v12.67.0
    Affected ranges
    • ECOSYSTEM: ≥ 12.45.0, < 12.68.0

    Update to 12.68.0

  • laravel/framework Packagist

    Versions
    • v13.0.0
    • v13.1.0
    • v13.1.1
    • v13.10.0
    • v13.11.0
    • v13.11.1
    • v13.11.2
    • v13.12.0
    • v13.13.0
    • v13.14.0
    • v13.15.0
    • v13.16.0
    • v13.16.1
    • v13.17.0
    • v13.18.0
    • v13.18.1
    • v13.19.0
    • v13.2.0
    • v13.20.0
    • v13.21.0
    • v13.21.1
    • v13.22.0
    • v13.23.0
    • v13.24.0
    • v13.25.0
    • v13.26.0
    • v13.26.1
    • v13.3.0
    • v13.4.0
    • v13.5.0
    • v13.6.0
    • v13.7.0
    • v13.8.0
    • v13.9.0
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.27.0

    Update to 13.27.0

Original sources

Check your server →