Data Query Logic Flaw in MongoDB Integration for Laravel by MongoDB

CVE-2026-96744

What is CVE-2026-96744?

A flaw in the MongoDB integration for Laravel enables improper handling of user-supplied lock owner values during cache lock operations. This can lead to scenarios where an authenticated user may manipulate the lock owner value, causing it to be interpreted as an aggregation expression instead of a literal. Consequently, this may allow the user to take control of or prematurely expire locks held by other processes, resulting in potential conflicts and duplicated operations within the application. This vulnerability underscores the necessity for robust input validation and secure handling of data within application frameworks.

References