{"schema_version":"1.9.0","id":"GHSA-5wcm-3v2w-8362","published":"2026-10-23T21:47:48Z","modified":"2026-10-23T22:00:04.735320237Z","aliases":["CVE-2026-114508"],"summary":"Laravel relationship inclusion can trigger unauthorized data destruction","details":"A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.\n\n### Impact\nA user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.","affected":[{"package":{"name":"laravel/framework","ecosystem":"Packagist","purl":"pkg:composer/laravel/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.45.0"},{"fixed":"12.68.0"}]}],"versions":["v12.45.0","v12.45.1","v12.45.2","v12.46.0","v12.47.0","v12.48.0","v12.48.1","v12.49.0","v12.50.0","v12.51.0","v12.52.0","v12.53.0","v12.54.0","v12.54.1","v12.55.0","v12.55.1","v12.56.0","v12.57.0","v12.58.0","v12.59.0","v12.60.0","v12.60.1","v12.60.2","v12.61.0","v12.61.1","v12.62.0","v12.63.0","v12.64.0","v12.65.0","v12.66.0","v12.67.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wcm-3v2w-8362/GHSA-5wcm-3v2w-8362.json"}},{"package":{"name":"laravel/framework","ecosystem":"Packagist","purl":"pkg:composer/laravel/framework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"fixed":"13.27.0"}]}],"versions":["v13.0.0","v13.1.0","v13.1.1","v13.10.0","v13.11.0","v13.11.1","v13.11.2","v13.12.0","v13.13.0","v13.14.0","v13.15.0","v13.16.0","v13.16.1","v13.17.0","v13.18.0","v13.18.1","v13.19.0","v13.2.0","v13.20.0","v13.21.0","v13.21.1","v13.22.0","v13.23.0","v13.24.0","v13.25.0","v13.26.0","v13.26.1","v13.3.0","v13.4.0","v13.5.0","v13.6.0","v13.7.0","v13.8.0","v13.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wcm-3v2w-8362/GHSA-5wcm-3v2w-8362.json"}}],"references":[{"type":"WEB","url":"https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114508"},{"type":"WEB","url":"https://github.com/laravel/framework/pull/61322"},{"type":"WEB","url":"https://github.com/laravel/framework/pull/61323"},{"type":"WEB","url":"https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e"},{"type":"WEB","url":"https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8"},{"type":"PACKAGE","url":"https://github.com/laravel/framework"},{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v12.68.0"},{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v13.27.0"}],"database_specific":{"cwe_ids":["CWE-470"],"github_reviewed":true,"github_reviewed_at":"2026-10-23T21:47:48Z","nvd_published_at":"2026-10-21T22:16:49Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}