CVE-2026-88028

MediumCVSS 6.5/10Last modified Sep 29, 2026

Description

Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-943

Affected software

Vendor	Product	Versions
MongoDB	Laravel MongoDB (PHP)	>= 1.2.0, < 5.11.0

References

https://jira.mongodb.org/browse/PHPLARA-265Vendor Advisory

Timeline

Published: Sep 10, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-880298.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supp CVE-2026-88033.7A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee CVE-2026-880308.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-suppli CVE-2026-880318.1Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied CVE-2026-880327.5A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an CVE-2026-880338.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-suppli CVE-2026-880348.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplie CVE-2026-880355.5A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accept CVE-2026-880368.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied CVE-2026-880376.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` sho CVE-2026-880384.8cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validat CVE-2026-88046.7Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameter