{"id":"CVE-2026-114508","aliases":["CLSA-2026-1793346652","DEBIAN-CVE-2026-114508","EUVD-2026-107582","GHSA-5wcm-3v2w-8362"],"status":"published","title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00406,"percentile":0.35357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470"],"published":"2026-10-21T21:45:31Z","modified":"2026-10-31T12:00:06Z","fixes":[{"ecosystem":"Packagist","package":"laravel/framework","fixed_in":["12.68.0","13.27.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"laravel/framework","fixed_in":["12.58.0-p7+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-laravel-framework","fixed_in":["13.31.0+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.45.0"},{"fixed":"12.68.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.27.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.58.0"},{"fixed":"12.58.0-p7+tuxcare"}]}],"versions":["12.58.0","12.58.0-p1+tuxcare","12.58.0-p2+tuxcare","12.58.0-p3+tuxcare","12.58.0-p4+tuxcare","12.58.0-p5+tuxcare","12.58.0-p6+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.48.25+dfsg-1","10.48.25+dfsg-2","10.48.29+dfsg-1","11.44.0-1","11.44.2+dfsg-1","11.46.1+dfsg-1","11.46.1+dfsg-2","11.46.1+dfsg-3","11.46.1+dfsg-4","13.31.0+dfsg-1","13.31.0+dfsg-2","8.83.26+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.48.29+dfsg-1","11.44.0-1","11.44.2+dfsg-1","11.46.1+dfsg-1","11.46.1+dfsg-2","11.46.1+dfsg-3","11.46.1+dfsg-4","13.31.0+dfsg-1","13.31.0+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.31.0+dfsg-1"}]}],"versions":["10.48.29+dfsg-1","11.44.0-1","11.44.2+dfsg-1","11.46.1+dfsg-1","11.46.1+dfsg-2","11.46.1+dfsg-3","11.46.1+dfsg-4"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.45.0"},{"fixed":"12.68.0"}]}],"versions":["v12.45.0","v12.45.1","v12.45.2","v12.46.0","v12.47.0","v12.48.0","v12.48.1","v12.49.0","v12.50.0","v12.51.0","v12.52.0","v12.53.0","v12.54.0","v12.54.1","v12.55.0","v12.55.1","v12.56.0","v12.57.0","v12.58.0","v12.59.0","v12.60.0","v12.60.1","v12.60.2","v12.61.0","v12.61.1","v12.62.0","v12.63.0","v12.64.0","v12.65.0","v12.66.0","v12.67.0"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.27.0"}]}],"versions":["v13.0.0","v13.1.0","v13.1.1","v13.10.0","v13.11.0","v13.11.1","v13.11.2","v13.12.0","v13.13.0","v13.14.0","v13.15.0","v13.16.0","v13.16.1","v13.17.0","v13.18.0","v13.18.1","v13.19.0","v13.2.0","v13.20.0","v13.21.0","v13.21.1","v13.22.0","v13.23.0","v13.24.0","v13.25.0","v13.26.0","v13.26.1","v13.3.0","v13.4.0","v13.5.0","v13.6.0","v13.7.0","v13.8.0","v13.9.0"]}],"products":[{"vendor":"flarum","product":"framework"},{"vendor":"laravel","product":"framework"}],"references":[{"url":"https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/laravel/framework/pull/61322","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/laravel/framework/pull/61323","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/laravel/framework/releases/tag/v12.68.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/laravel/framework/releases/tag/v13.27.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114508","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5wcm-3v2w-8362"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114508.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-114508","tags":["advisory"]},{"url":"https://github.com/laravel/framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-114508","title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","status":"published","published":"2026-10-21T21:45:31.465Z","modified":"2026-10-23T21:18:11.415Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-107582","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","status":"published","published":"2026-10-21T21:45:31Z","modified":"2026-10-23T21:18:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:59:31.865878Z"}],"ghsa":[{"id":"GHSA-5wcm-3v2w-8362","title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.","status":"published","published":"2026-10-23T21:47:48Z","modified":"2026-10-23T21:47:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-114508","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","status":"published","published":"2026-10-21T22:16:49.553Z","modified":"2026-10-23T22:16:57.22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-114508","title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","status":"published","published":"2026-10-21T21:45:31.465Z","modified":"2026-10-28T02:30:47.278968129Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"DEBIAN-CVE-2026-114508","description":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","status":"published","published":"2026-10-21T22:16:49.553Z","modified":"2026-10-31T12:00:06.77010726Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-5wcm-3v2w-8362","title":"Laravel relationship inclusion can trigger unauthorized data destruction","description":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.","status":"published","published":"2026-10-23T21:47:48Z","modified":"2026-10-23T22:00:04.735320237Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"CLSA-2026-1793346652","title":"TuxCare security update for laravel/framework (1 CVE)","description":"TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 12.58.0-p7+tuxcare.","status":"published","published":"2026-10-30T08:50:53Z","modified":"2026-10-30T13:30:10.695579892Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}