Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-114508 Overview
CVE-2026-114508 affects the Laravel web application framework. Crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user holding read access but no write permission can empty related-table data through this flaw. The result is irreversible data loss, denial of service, and loss of data integrity. The vulnerability affects Laravel versions from 12.45.0 up to (but not including) 12.68.0, and 13.x releases prior to 13.27.0. The weakness maps to CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Fixes landed in Laravel 12.68.0 and 13.27.0.
Critical Impact
Low-privileged users with only read access can destroy data in related tables via a crafted relationship inclusion parameter, causing irreversible data loss and service disruption.
Affected Products
- Laravel Framework versions 12.45.0 through 12.67.x
- Laravel Framework versions 13.0.0 through 13.26.x
- Applications using Eloquent relationship inclusion on read-only endpoints
Discovery Timeline
- 2026-10-21 - CVE-2026-114508 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114508
Vulnerability Analysis
The flaw resides in Laravel's handling of relationship inclusion parameters on read-oriented endpoints. Attackers supply crafted relation names that the framework resolves against Eloquent models without verifying that the resolved operation is a safe read. Instead of returning related rows, the resolution path can dispatch a destructive query against the related table. The outcome is deletion or truncation of records on a table the caller has no write permission to touch. The authorization layer evaluates the primary request, not the subsequent operation triggered by the relationship string.
Root Cause
The root cause is externally-controlled input selecting the method or query executed on a related model [CWE-470]. The relationship resolver trusts caller-supplied strings to pick behavior without enforcing a read-only contract. Permission checks apply to the endpoint, not to the derived relationship action.
Attack Vector
Exploitation requires only network access to an affected endpoint that honors relationship inclusion query parameters. The attacker submits a request to a read-only route and supplies a crafted include value referencing a destructive relationship pathway. No elevated privileges are needed; read access is sufficient. Successful exploitation empties the targeted related table, producing data loss and denial of service for dependent features. See the GitHub Security Advisory GHSA-5wcm-3v2w-8362 for maintainer-authored technical context.
// No verified proof-of-concept code is published for this CVE.
// Refer to the vendor advisory and fix commits for technical details:
// - https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
// - https://github.com/laravel/framework/pull/61323
Detection Methods for CVE-2026-114508
Indicators of Compromise
- Unexpected mass deletions or table truncation on tables related to read-only API resources.
- HTTP requests to read-only endpoints containing include=, with=, or similar relationship parameters with unusual or nested relation names.
- Audit log gaps where related-table rows disappear without a matching authorized write operation.
Detection Strategies
- Inspect web and application logs for GET or read-equivalent requests that correlate in time with DELETE or TRUNCATE statements on related tables.
- Enable database query logging on Laravel applications and alert on destructive statements originating from controllers mapped to read-only routes.
- Compare running Laravel versions against fixed releases 12.68.0 and 13.27.0 using composer inventory data.
Monitoring Recommendations
- Forward application, web server, and database audit logs to a centralized analytics platform for cross-source correlation.
- Alert on anomalous row-count drops on tables exposed through API relationships.
- Track low-privilege accounts that generate database-modifying activity through read endpoints.
How to Mitigate CVE-2026-114508
Immediate Actions Required
- Upgrade Laravel to version 12.68.0 or 13.27.0 as published in the v12.68.0 release and v13.27.0 release.
- Audit API resources that accept relationship inclusion parameters for exposure to untrusted or low-privileged callers.
- Review database audit logs for destructive statements against related tables since deployment of an affected version.
Patch Information
Laravel addressed the issue in versions 12.68.0 and 13.27.0. The corrective changes are tracked in pull request #61322 and pull request #61323, with code landed in commits 50a7970 and b89f294. Upgrade via composer update laravel/framework and retest relationship-inclusion endpoints.
Workarounds
- Restrict or allow-list the relationship names accepted by read-only endpoints until the framework is upgraded.
- Enforce database-level permissions so that application roles mapped to read endpoints lack DELETE and TRUNCATE rights on related tables.
- Place a web application firewall rule in front of affected endpoints to block suspicious include or with parameters pending the upgrade.
# Upgrade Laravel to a fixed release
composer require laravel/framework:^12.68.0 --update-with-dependencies
# or for the 13.x branch
composer require laravel/framework:^13.27.0 --update-with-dependencies
# Verify installed version
php artisan --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
