---
id: CVE-2026-118510
title: Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
summary: >-
  A type-handling flaw in the relationship query building of this MongoDB
  integration library can cause a check for the absence of a related record to
  be compiled with an identifier of the wrong data type. In an application that
  relies on …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-843
vendor: MongoDB
product: mongodb/laravel-mongodb
affected:
  - mongodb/laravel-mongodb >= 3.2.3 < 5.12.0
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:15:08.426Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118510'
references:
  - url: 'https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0'
  - url: 'https://jira.mongodb.org/browse/PHPLARA-148'
tags:
  - cve.org
ingestedAt: '2026-10-28T17:14:44.496Z'
---

## Overview

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

## Affected

- `mongodb/laravel-mongodb >= 3.2.3 < 5.12.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.