{"id":"GHSA-5wcm-3v2w-8362","aliases":["CVE-2026-114508"],"title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.","severity":"medium","score":6.5,"published":"2026-10-23T21:47:48.000Z","modified":"2026-10-23T22:00:04.735Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"laravel/framework","ranges":[{"events":[{"introduced":"12.45.0"},{"fixed":"12.68.0"}],"type":"ECOSYSTEM"}],"versions":["v12.45.0","v12.45.1","v12.45.2","v12.46.0","v12.47.0","v12.48.0","v12.48.1","v12.49.0","v12.50.0","v12.51.0","v12.52.0","v12.53.0","v12.54.0","v12.54.1","v12.55.0","v12.55.1","v12.56.0","v12.57.0","v12.58.0","v12.59.0","v12.60.0","v12.60.1","v12.60.2","v12.61.0","v12.61.1","v12.62.0","v12.63.0","v12.64.0","v12.65.0","v12.66.0","v12.67.0"],"fixed":["12.68.0"]},{"ecosystem":"Packagist","name":"laravel/framework","ranges":[{"events":[{"introduced":"13.0.0"},{"fixed":"13.27.0"}],"type":"ECOSYSTEM"}],"versions":["v13.0.0","v13.1.0","v13.1.1","v13.10.0","v13.11.0","v13.11.1","v13.11.2","v13.12.0","v13.13.0","v13.14.0","v13.15.0","v13.16.0","v13.16.1","v13.17.0","v13.18.0","v13.18.1","v13.19.0","v13.2.0","v13.20.0","v13.21.0","v13.21.1","v13.22.0","v13.23.0","v13.24.0","v13.25.0","v13.26.0","v13.26.1","v13.3.0","v13.4.0","v13.5.0","v13.6.0","v13.7.0","v13.8.0","v13.9.0"],"fixed":["13.27.0"]}],"references":["https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362","https://nvd.nist.gov/vuln/detail/CVE-2026-114508","https://github.com/laravel/framework/pull/61322","https://github.com/laravel/framework/pull/61323","https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e","https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8","https://github.com/laravel/framework","https://github.com/laravel/framework/releases/tag/v12.68.0","https://github.com/laravel/framework/releases/tag/v13.27.0"],"sources":[{"name":"OSV","id":"GHSA-5wcm-3v2w-8362","modified":"2026-10-23T22:00:04.735320237Z","url":"https://osv.dev/vulnerability/GHSA-5wcm-3v2w-8362"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5}]}