CVE-2025-48490: Laravel Rest Api Validation Bypass Flaw

CVE-2025-48490 Overview

CVE-2025-48490 is a validation bypass vulnerability in Laravel Rest API, an API generator package maintained by Lomkit. The flaw affects all versions prior to 2.13.0. The framework merges validation rules across multiple contexts, including index, store, and update actions. When multiple validations are defined for the same attribute, later definitions silently override earlier ones. Attackers can craft requests that bypass expected validation rules and inject unexpected or dangerous parameters into the application. This may result in unauthorized data being accepted or processed by the API. The issue is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Attackers can bypass server-side input validation by exploiting rule-merging behavior, allowing injection of unsanitized parameters into API endpoints.

Affected Products

Lomkit Laravel Rest API versions prior to 2.13.0
Laravel applications using the laravel-rest-api package for API generation
REST endpoints exposing index, store, and update actions defined via the package

Discovery Timeline

2025-05-30 - CVE-2025-48490 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48490

Vulnerability Analysis

Laravel Rest API defines validation rules per resource action. The package merges these rule sets when a request is processed. When the same attribute has multiple rules across contexts, the merge logic silently overwrites prior definitions instead of combining or preserving stricter constraints. Attackers craft requests targeting an action context in which validation rules for a given attribute are absent or weaker. The API accepts the request payload without enforcing the intended constraints, allowing unexpected fields or values through. The impact depends on how downstream code consumes the validated data. Business logic that trusts validated input may process attacker-controlled values, leading to unauthorized mutation or data injection.

Root Cause

The root cause lies in the rule aggregation logic within the request layer, specifically involving MutateRequest and the resource relation resolution path. Rules defined in one context override rules for the same attribute defined in another, without conflict detection. The patch in version 2.13.0 refactors the mutation rule namespace from Lomkit\Rest\Rules\MutateRules to Lomkit\Rest\Rules\Mutate\Mutate and tightens the relation() method signature to enforce a string type.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to an API endpoint exposed by the vulnerable package. The request includes attributes that are validated in one action context but not another, or leverages the override behavior to submit values that would otherwise fail validation.

php

// Security patch in src/Http/Requests/MutateRequest.php
namespace Lomkit\Rest\Http\Requests;

-use Lomkit\Rest\Rules\MutateRules;
+use Lomkit\Rest\Rules\Mutate\Mutate;

class MutateRequest extends RestRequest
{

php

// Security patch in src/Concerns/Resource/Relationable.php
/**
 * Get a relation by name.
 *
- * @param string $name
- *
 * @return Relation|null
 */
-public function relation($name)
+public function relation(string $name)
{
    $name = relation_without_pivot($name);

Source: GitHub Commit 88b1458

Detection Methods for CVE-2025-48490

Indicators of Compromise

API request bodies containing attributes that should be rejected by declared validation rules but return 2xx responses.
Database records showing values outside expected constraints for fields validated by Laravel Rest API resources.
Unexpected field mutations on store or update endpoints where the field is not declared in the resource's fields list.

Detection Strategies

Review installed Composer dependencies for lomkit/laravel-rest-api at versions below 2.13.0 using composer show lomkit/laravel-rest-api.
Audit application logs for API requests with anomalous payload shapes targeting resource endpoints.
Compare validated request data against persisted records to identify fields that bypassed declared rules.

Monitoring Recommendations

Enable verbose request logging on Laravel Rest API endpoints, capturing raw request bodies and validated attribute sets.
Alert on write operations to sensitive columns that are not explicitly whitelisted in resource configuration.
Track version drift of the lomkit/laravel-rest-api package across environments using software composition analysis tooling.

How to Mitigate CVE-2025-48490

Immediate Actions Required

Upgrade lomkit/laravel-rest-api to version 2.13.0 or later using Composer.
Audit all resource classes for attributes with rules defined across multiple action contexts and confirm the intended constraints apply after upgrade.
Review recent API traffic and database changes for evidence of validation bypass on affected endpoints.

Patch Information

The vulnerability is patched in Laravel Rest API version 2.13.0. The fix is documented in GitHub Security Advisory GHSA-69rh-hccr-cxrj and implemented in Pull Request #172. The patch commit is 88b14587b4efd7e59d7379658c606d325bb513b4.

Workarounds

Consolidate validation rules for shared attributes into a single authoritative context to avoid silent overrides until the upgrade is applied.
Add application-layer validation in controllers or model observers to enforce constraints independently of the package's rule merging.
Restrict access to affected API endpoints via authentication middleware or network-level controls where feasible.

bash

# Upgrade the vulnerable package to the patched release
composer require lomkit/laravel-rest-api:^2.13.0
composer update lomkit/laravel-rest-api
php artisan config:clear