Medium severity · published Oct 21, 2026
CVE-2026-114508
Laravel relationship inclusion can trigger unauthorized data destruction
New
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
framework · laravel
>= 12.45.0, < 12.68.0; >= 13.0.0, < 13.27.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114508
github.com
https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
github.com
https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
github.com
https://github.com/laravel/framework/pull/61322
github.com
https://github.com/laravel/framework/pull/61323
github.com
https://github.com/laravel/framework/releases/tag/v12.68.0
github.com
https://github.com/laravel/framework/releases/tag/v13.27.0
More from framework
9.8
CVE-2025-27515
Laravel is a web application framework
9.8
CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for…
9.2
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
8.9
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
8.8
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17