{"id":"CVE-2026-114508","aliases":["GHSA-5wcm-3v2w-8362"],"title":"Laravel relationship inclusion can trigger unauthorized data destruction","summary":"Laravel relationship inclusion can trigger unauthorized data destruction","severity":"medium","cvss":6.5,"cwe":["CWE-470"],"vendor":"laravel","product":"laravel/framework","ecosystem":"composer","affected":["laravel/framework >= 12.45.0, < 12.68.0","laravel/framework >= 13.0.0, < 13.27.0"],"patched":["laravel/framework 12.68.0","laravel/framework 13.27.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:47:49Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5wcm-3v2w-8362","references":[{"url":"https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114508"},{"url":"https://github.com/laravel/framework/pull/61322"},{"url":"https://github.com/laravel/framework/pull/61323"},{"url":"https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e"},{"url":"https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8"},{"url":"https://github.com/laravel/framework/releases/tag/v12.68.0"},{"url":"https://github.com/laravel/framework/releases/tag/v13.27.0"},{"url":"https://github.com/advisories/GHSA-5wcm-3v2w-8362"}],"tags":["ghsa","composer","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-23T17:32:51.979205Z"},"epss":0.00406,"epssPercentile":0.3472,"ingestedAt":"2026-10-21T22:18:33.746Z","slug":"CVE-2026-114508","body":"## Overview\n\nA vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.\n\n## Affected packages\n\n- `laravel/framework >= 12.45.0, < 12.68.0`\n- `laravel/framework >= 13.0.0, < 13.27.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `laravel/framework 12.68.0`\n- `laravel/framework 13.27.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}