Destructive Database Operations in Laravel Framework by Vendor
CVE-2026-114508
6.5MEDIUM
What is CVE-2026-114508?
The Laravel framework has a vulnerability where a crafted relationship inclusion on a read-only endpoint can result in unintended destructive operations that clear data from related tables. This issue allows users with read access, yet lacking write permissions, to inadvertently erase critical data, leading to potential data loss, denial of service, and compromised data integrity. This serious flaw is addressed in Laravel versions 12.68.0 and 13.27.0, emphasizing the importance for users to upgrade to these secure versions to prevent irreversible data damage.
Affected Version(s)
framework >= 12.45.0, < 12.68.0 < 12.45.0, 12.68.0
framework >= 13.0.0, < 13.27.0 < 13.0.0, 13.27.0