GHSA-5wcm-3v2w-8362
Laravel relationship inclusion can trigger unauthorized data destruction
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | laravel/framework | >= 12.45.0, < 12.68.0 | 12.68.0 |
| Packagist | laravel/framework | >= 13.0.0, < 13.27.0 | 13.27.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
### Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
- https://nvd.nist.gov/vuln/detail/CVE-2026-114508
- https://github.com/laravel/framework/pull/61322
- https://github.com/laravel/framework/pull/61323
- https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
- https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
- https://github.com/laravel/framework
- https://github.com/laravel/framework/releases/tag/v12.68.0
- https://github.com/laravel/framework/releases/tag/v13.27.0