Vulnerability advisory

CVE-2026-114508

Laravel relationship inclusion can trigger unauthorized data destruction

Published Oct 21, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/laravel/framework ↗
9dfd2afc48f2519bfdbe6862dfb9849491c673ad to before 1343c22b92edd48e29ff273d8ce7c15cf75d974c	`1343c22b92edd48e29ff273d8ce7c15cf75d974c`
3e33f431a05365d008742ff8001b92641086d5f8 to before f3fa8f3591fa2e8f0b7dedfffc3fc324d2aad31b	`f3fa8f3591fa2e8f0b7dedfffc3fc324d2aad31b`
Not specified	`50a7970efe9f9990b6ec4f1e949de2abaaf4263e`
Not specified	`b89f2944995d555bfda76dced1ef6c6b04ef17d8`
Also listed as affected (65) `v13.26.1` `v12.67.0` `v13.26.0` `v12.66.0` `v13.25.0` `v12.65.0` `v13.24.0` `v13.23.0` `v13.22.0` `v13.21.1` `v13.21.0` `v12.64.0` `v13.20.0` `v12.63.0` `v13.19.0` `v13.18.1` `v13.18.0` `v13.17.0` `v13.16.1` `v13.16.0` `v12.62.0` `v13.15.0` `v13.14.0` `v12.61.1` `v13.13.0` `v12.61.0` `v13.12.0` `v12.60.2` `v13.11.2` `v12.60.1` `v13.11.1` `v12.60.0` `v13.11.0` `v13.10.0` `v12.59.0` `v13.9.0` `v13.8.0` `v13.7.0` `v12.58.0` `v12.57.0` `v13.6.0` `v13.5.0` `v13.4.0` `v13.3.0` `v12.56.0` `v13.2.0` `v13.1.1` `v13.1.0` `v12.55.1` `v13.0.0` `v12.55.0` `v12.54.1` `v12.54.0` `v12.53.0` `v12.52.0` `v12.51.0` `v12.50.0` `v12.49.0` `v12.48.1` `v12.48.0` `v12.47.0` `v12.46.0` `v12.45.2` `v12.45.1` `v12.45.0`

Description

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

CVE-2026-114508

Affected versions

Repository

Description

References