CVE-2026-114508

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-470

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
laravel	framework	>= 12.45.0, < 12.68.0; >= 13.0.0, < 13.27.0

References

Timeline

Published: Oct 21, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1145099.2Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not rej CVE-2026-114517.3A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol CVE-2026-1145107.1Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, an CVE-2026-1145156.5OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior CVE-2026-1145198.6Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read CVE-2026-114527.3A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the compo CVE-2026-1145239.8Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allo CVE-2026-1145247.2Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Forma CVE-2026-1145257.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This iss CVE-2026-1145267.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. T CVE-2026-1145277.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scri CVE-2026-1145287.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. T