{"id":"CVE-2026-114508","summary":"Laravel relationship inclusion can trigger unauthorized data destruction","details":"Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.","aliases":["GHSA-5wcm-3v2w-8362"],"modified":"2026-10-22T10:46:05.126891634Z","published":"2026-10-21T21:45:31.465Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114508.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-470"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114508.json"},{"type":"FIX","url":"https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e"},{"type":"FIX","url":"https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8"},{"type":"FIX","url":"https://github.com/laravel/framework/pull/61322"},{"type":"FIX","url":"https://github.com/laravel/framework/pull/61323"},{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v12.68.0"},{"type":"WEB","url":"https://github.com/laravel/framework/releases/tag/v13.27.0"},{"type":"ADVISORY","url":"https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114508"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laravel/framework","events":[{"introduced":"9dfd2afc48f2519bfdbe6862dfb9849491c673ad"},{"fixed":"1343c22b92edd48e29ff273d8ce7c15cf75d974c"},{"introduced":"3e33f431a05365d008742ff8001b92641086d5f8"},{"fixed":"f3fa8f3591fa2e8f0b7dedfffc3fc324d2aad31b"},{"fixed":"50a7970efe9f9990b6ec4f1e949de2abaaf4263e"},{"fixed":"b89f2944995d555bfda76dced1ef6c6b04ef17d8"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"12.45.0"},{"fixed":"12.68.0"}]},{"strategy":"StringRangeExpression","range":[{"introduced":"13.0.0"},{"fixed":"13.27.0"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"50a7970efe9f9990b6ec4f1e949de2abaaf4263e"}]},{"range":[{"fixed":"b89f2944995d555bfda76dced1ef6c6b04ef17d8"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v12.68.0","range":[{"fixed":"1343c22b92edd48e29ff273d8ce7c15cf75d974c"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"v13.27.0","range":[{"fixed":"f3fa8f3591fa2e8f0b7dedfffc3fc324d2aad31b"}]}]}}],"versions":["v13.26.1","v12.67.0","v13.26.0","v12.66.0","v13.25.0","v12.65.0","v13.24.0","v13.23.0","v13.22.0","v13.21.1","v13.21.0","v12.64.0","v13.20.0","v12.63.0","v13.19.0","v13.18.1","v13.18.0","v13.17.0","v13.16.1","v13.16.0","v12.62.0","v13.15.0","v13.14.0","v12.61.1","v13.13.0","v12.61.0","v13.12.0","v12.60.2","v13.11.2","v12.60.1","v13.11.1","v12.60.0","v13.11.0","v13.10.0","v12.59.0","v13.9.0","v13.8.0","v13.7.0","v12.58.0","v12.57.0","v13.6.0","v13.5.0","v13.4.0","v13.3.0","v12.56.0","v13.2.0","v13.1.1","v13.1.0","v12.55.1","v13.0.0","v12.55.0","v12.54.1","v12.54.0","v12.53.0","v12.52.0","v12.51.0","v12.50.0","v12.49.0","v12.48.1","v12.48.0","v12.47.0","v12.46.0","v12.45.2","v12.45.1","v12.45.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114508.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}