CVE-2026-114508

mediumpriority · track · 0EPSS 0.004 · 35 %ileDEUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.41% (35th) EPSS
CVSS 6.5 · medium
Is it mine?
4 products
Check your exposure
Who says so?
2 sources
cert_bund · osv

EPSS · scored 2026-10-27

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

01

cvss

Technical severity, 0–10. One row per scoring source.

6.5
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · security-advisories@github.comexploitability 3.9 · impact 2.5
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · OSV
v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-470USCWE-470US
04

affected products (4)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2026-4046Laravel: Mehrere SchwachstellenDeutsch2026-10-19csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Laravel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.

  • GHSA-5wcm-3v2w-8362Laravel relationship inclusion can trigger unauthorized data destruction2026-10-23ghsa · osvUS

    A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. ### Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

06

sources

Which sources assert this record, and when.

cert_bundosvNVDCVE.orgMITRE
published 2026-10-21modified 2026-10-23
07

references (7) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan