CVE-2025-48490
mediumpriority · track · 0EPSS 0.006 · 50 %ileEUUSEPSS · scored 2026-10-27
Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-69rh-hccr-cxrjLaravel Rest Api has a Search Validation Bypass2025-05-27ghsa · osvUS
A validation bypass vulnerability was discovered prior to version 2.13.0, where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. Impact: This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. Patch: The issue was fixed in [PR #172](https://github.com/Lomkit/laravel-rest-api/pull/172) by ensuring that multiple rule definitions are merged correctly rather than overwritten.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://github.com/Lomkit/laravel-rest-api/commit/88b14587b4efd7e59d7379658c606d325bb513b4cnnvd
- https://github.com/Lomkit/laravel-rest-api/pull/172cnnvd
- https://github.com/Lomkit/laravel-rest-api/releasesPatchcnnvd
- https://github.com/Lomkit/laravel-rest-api/security/advisories/GHSA-69rh-hccr-cxrjcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-48490cnnvd
- https://github.com/Lomkit/laravel-rest-api/commit/88b14587b4efd7e59d7379658c606d325bb513b4enisa_euvd
- https://github.com/Lomkit/laravel-rest-api/pull/172enisa_euvd
- https://github.com/Lomkit/laravel-rest-api/security/advisories/GHSA-69rh-hccr-cxrjenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan