{"id":"CVE-2026-118510","title":"Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs","summary":"A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-843"],"vendor":"MongoDB","product":"mongodb/laravel-mongodb","affected":["mongodb/laravel-mongodb >= 3.2.3 < 5.12.0"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:15:08.426Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118510","references":[{"url":"https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0"},{"url":"https://jira.mongodb.org/browse/PHPLARA-148"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.496Z","epss":0.00282,"epssPercentile":0.20883,"slug":"CVE-2026-118510","body":"## Overview\n\nA type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.\n\n## Affected\n\n- `mongodb/laravel-mongodb >= 3.2.3 < 5.12.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}