CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- Record
CVE-2026-114508- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-470
- Updated
- 2026-11-02
EUVDEUVD-2026-107582
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- Record
EUVD-2026-107582- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5wcm-3v2w-8362
Laravel relationship inclusion can trigger unauthorized data destruction
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
- Record
GHSA-5wcm-3v2w-8362- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-470
- Updated
- 2026-11-02
NVD
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- Record
CVE-2026-114508- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-470
- Updated
- 2026-11-02
OSV
Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- Record
CVE-2026-114508- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-470
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-114508
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- Record
DEBIAN-CVE-2026-114508- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-5wcm-3v2w-8362
Laravel relationship inclusion can trigger unauthorized data destruction
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
- Record
GHSA-5wcm-3v2w-8362- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-470
- Updated
- 2026-11-02
OSVCLSA-2026-1793346652 No score
TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p7+tuxcare.
- Record
CLSA-2026-1793346652- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
laravel/frameworkPackagist |
12.45.0 up to 12.68.0 | 12.68.0 |
laravel/frameworkPackagist |
13.0.0 up to 13.27.0 | 13.27.0 |
laravel/frameworkTuxCare:Packagist |
12.58.0 up to 12.58.0-p7+tuxcare, plus listed versions 12.58.0-p1+tuxcare12.58.0-p2+tuxcare12.58.0-p3+tuxcare12.58.0-p4+tuxcare12.58.0-p5+tuxcare12.58.0-p6+tuxcare |
12.58.0-p7+tuxcare |
php-laravel-frameworkDebian:12 |
All versions, plus listed versions 10.48.25+dfsg-110.48.25+dfsg-210.48.29+dfsg-111.44.0-111.44.2+dfsg-1 Show 7 moreShow less11.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-413.31.0+dfsg-113.31.0+dfsg-28.83.26+dfsg-2 |
None known |
php-laravel-frameworkDebian:13 |
All versions, plus listed versions 10.48.29+dfsg-111.44.0-111.44.2+dfsg-111.46.1+dfsg-111.46.1+dfsg-2 Show 4 moreShow less11.46.1+dfsg-311.46.1+dfsg-413.31.0+dfsg-113.31.0+dfsg-2 |
None known |
php-laravel-frameworkDebian:14 |
before 13.31.0+dfsg-1, plus listed versions 10.48.29+dfsg-111.44.0-111.44.2+dfsg-111.46.1+dfsg-111.46.1+dfsg-211.46.1+dfsg-311.46.1+dfsg-4 |
13.31.0+dfsg-1 |
laravel/frameworkPackagist |
12.45.0 up to 12.68.0, plus listed versions v12.45.0v12.45.1v12.45.2v12.46.0v12.47.0 Show 26 moreShow lessv12.48.0v12.48.1v12.49.0v12.50.0v12.51.0v12.52.0v12.53.0v12.54.0v12.54.1v12.55.0v12.55.1v12.56.0v12.57.0v12.58.0v12.59.0v12.60.0v12.60.1v12.60.2v12.61.0v12.61.1v12.62.0v12.63.0v12.64.0v12.65.0v12.66.0v12.67.0 |
12.68.0 |
laravel/frameworkPackagist |
13.0.0 up to 13.27.0, plus listed versions v13.0.0v13.1.0v13.1.1v13.10.0v13.11.0 Show 29 moreShow lessv13.11.1v13.11.2v13.12.0v13.13.0v13.14.0v13.15.0v13.16.0v13.16.1v13.17.0v13.18.0v13.18.1v13.19.0v13.2.0v13.20.0v13.21.0v13.21.1v13.22.0v13.23.0v13.24.0v13.25.0v13.26.0v13.26.1v13.3.0v13.4.0v13.5.0v13.6.0v13.7.0v13.8.0v13.9.0 |
13.27.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114508 is a medium vulnerability (CVSS 6.5) in Flarum Framework, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in laravel/framework 12.68.0.
References
github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362