{"id":"CVE-2026-118510","aliases":[],"cve":{"records":[{"id":"CVE-2026-118510","source":"mongodb","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T13:54:17.756Z","published":"2026-10-28T16:15:08.426Z","modified":"2026-10-28T16:15:08.426Z"}],"publishers":[{"name":"mongodb","role":"CNA","organizationId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","modified":"2026-10-28T16:15:08.426Z"}],"references":[{"url":"https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0","tags":[],"source":"mongodb"},{"url":"https://jira.mongodb.org/browse/PHPLARA-148","tags":[],"source":"mongodb"}],"weaknesses":[{"id":"CWE-843","description":"CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')","source":"mongodb"}],"applicability":[],"prioritization":[]},"title":"Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs","titleSource":"mongodb","descriptionSource":"mongodb","description":"A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.","score":8.8,"severity":"high","published":"2026-10-28T16:15:08.426Z","modified":"2026-10-28T16:15:08.426Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MongoDB","name":"Laravel MongoDB","platforms":[],"versions":[{"version":"3.2.3","status":"affected","lessThan":"5.12.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"mongodb","url":"https://www.cve.org/CVERecord?id=CVE-2026-118510"}],"remediation":[],"references":["https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0","https://jira.mongodb.org/browse/PHPLARA-148"],"sources":[{"name":"CVE","id":"CVE-2026-118510","modified":"2026-10-28T16:15:08.426Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118510"}],"assessments":[{"source":"mongodb","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.7},{"source":"mongodb","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-29T14:37:25.295Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Laravel MongoDB versions before 5.12.0 are affected by a type-handling flaw, allowing users with basic privileges to access or modify documents they should not. The flaw occurs in the `whereDoesntHave` method. A user may be served, change, or remove documents that the check was intended to withhold.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:24:08.604Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118510"}]}}