CVE-2026-114508— Laravel relationship inclusion can trigger unauthorized data destruction
Quick assessment
Affected
laravel framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Laravel 是一个 Web 应用框架。在 12.45.0 至 12.68.0 以及 13.27.0 版本中，针对只读端点精心构造的关系包含（relationship inclusion）请求，可能触发对相关表的破坏性数据库操作，而非正常检索数据。拥有读取权限但无写入权限的用户可借此清空相关表中的数据，导致不可逆的数据丢失、拒绝服务（DoS）以及数据完整性受损。该问题已在 12.68.0 和 13.27.0 版本中修复。
Possible ATT&CK Techniques 3 AI
T1499 · Endpoint Denial of Service T1565 · Data Manipulation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114508
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Laravel relationship inclusion can trigger unauthorized data destruction
Source: CVE Program / CVE List V5
Vulnerability Description
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114508
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114508
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-114508 (3)
Vendor Pages for CVE-2026-114508 (2)
-
🔗 Release v13.27.0 · laravel/framework · GitHub x_refsource_MISC
-
🔗 Release v12.68.0 · laravel/framework · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: framework
-
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string -
CVE-2026-110803
Session Lock Leak on an Invalid UI Id Allows Denial of Servi -
CVE-2026-102279
Laravel: XSS in Debug Page Information -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototyp
Same vendor: laravel
-
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string -
CVE-2026-102279
Laravel: XSS in Debug Page Information -
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP -
CVE-2026-73683
Laravel Socialite Facebook Provider Authentication Bypass vi -
CVE-2026-39976
Laravel Passport's TokenGuard Authenticates Unrelated User f
Same weakness: CWE-470
-
CVE-2026-114660
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex -
CVE-2026-92206
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remo -
CVE-2026-112145
speaches-ai speaches Pyannote Diarization Model Loading pyan -
CVE-2026-71253
Apache Johnzon: ClassConverter loads & static-initializes an -
CVE-2026-111440
JDBC LogFactory 任意类加载/构造导致潜在 RCE
V. Comments for CVE-2026-114508
No comments yet