CVE-2026-114508

6.5 Moyenne

Publiée le 22/10/2026 à 00:16 · Modifiée le 22/10/2026 à 00:16 · Reçue · Source : security-advisories@github.com

Description

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Traduire en français

Produits concernés

laravel framework

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-470

Références

https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
https://github.com/laravel/framework/pull/61322
https://github.com/laravel/framework/pull/61323
https://github.com/laravel/framework/releases/tag/v12.68.0
https://github.com/laravel/framework/releases/tag/v13.27.0
https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories