Improper Neutralization in MongoDB Integration for Laravel
CVE-2026-88028

7.1HIGH

Key Information:

Vendor

Mongodb
Status
Laravel Mongodb (PHP)
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88028?

The MongoDB integration for Laravel contains a vulnerability that arises from improper handling of polymorphic relations. An authenticated user with the ability to modify a stored relation identifier can manipulate the application's query logic. This manipulation may lead the application to retrieve documents that are not intended, potentially exposing sensitive information and compromising data integrity.

Affected Version(s)

Laravel MongoDB (PHP) 1.2.0 < 5.11.0

References

https://jira.mongodb.org/browse/PHPLARA-265

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.