CVE-2026-114508

The record

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Affected packages

Related vulnerabilities

• CVE-2026-119578 MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg… CWE-470
• CVE-2026-108097 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
• CVE-2026-108099 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CWE-470
• CVE-2026-119050 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that… CWE-470
• CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
• CVE-2026-115931 Postiz lets a signed-in user ask the backend to run a function on one of their connected… CWE-470
• CVE-2026-115886 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-470
• CVE-2026-115749 hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an… CWE-470