CVE-2026-114508

MEDIUM 6.5

Laravel relationship inclusion can trigger unauthorized data destruction

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

CWE	CWE-470
Vendor	laravel
Product	framework
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for laravel framework

Be the first to know when new medium vulnerabilities affecting laravel framework are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

laravel / framework

>= 12.45.0, < 12.68.0 >= 13.0.0, < 13.27.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362 github.com: https://github.com/laravel/framework/pull/61322 github.com: https://github.com/laravel/framework/pull/61323 github.com: https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e github.com: https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8 github.com: https://github.com/laravel/framework/releases/tag/v12.68.0 github.com: https://github.com/laravel/framework/releases/tag/v13.27.0