Skip to content
Sign in
6.5 Medium

CVE-2026-114508 Laravel is a web application framework

Description

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Affected products and versions

Product Affected versions Fixed in
framework 13.0 13.0.0 → < 13.27.0 13.27.0
framework 12.45 12.45.0 → < 12.68.0 12.68.0

Other CVEs of framework

The 9 CVEs of framework →
CVE-2026-114509 Laravel is a web application framework 9.2 Critical CVE-2026-102279 Laravel is a web application framework 3.1 Low CVE-2026-48019 Laravel is a web application framework 8.9 High CVE-2025-27515 Laravel is a web application framework 6.9 Medium
Track this CVE