Read the docs
TI-2026-79036 Aliases CVE-2026-114508GHSA-5wcm-3v2w-8362

Relationship inclusion in Laravel can empty related database tables

Priority LOW 35CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Laravel framework from 12.45.0 before 12.68.0 and from 13.0.0 before 13.27.0 is affected. Crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss and denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed framework (laravel): 12.68.0, 13.27.0laravel/framework (Packagist): 12.68.0, 13.27.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Laravelframework12.45.0 to before 12.68.0; 13.0.0 to before 13.27.012.68.0, 13.27.0Patch availableCNA
—laravel/framework (Packagist)12.45.0 to before 12.68.012.68.0Patch availableGHSA-5wcm-3v2w-8362
—laravel/framework (Packagist)13.0.0 to before 13.27.013.27.0Patch availableGHSA-5wcm-3v2w-8362
  • framework VendorLaravel Affected 12.45.0 to before 12.68.0; 13.0.0 to before 13.27.0 Fixed in 12.68.0, 13.27.0 Patch available CNA
  • laravel/framework (Packagist) Vendor— Affected 12.45.0 to before 12.68.0 Fixed in 12.68.0 Patch available GHSA-5wcm-3v2w-8362
  • laravel/framework (Packagist) Vendor— Affected 13.0.0 to before 13.27.0 Fixed in 13.27.0 Patch available GHSA-5wcm-3v2w-8362

Remediation

Update laravel/framework to 12.68.0 or 13.27.0. The sources list no fixed version for laravel framework outside these release lines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA framework (laravel) Fixed in 12.68.0, 13.27.0
  • Fix · GHSA-5wcm-3v2w-8362 laravel/framework (Packagist) Fixed in 12.68.0 Advisory →
  • Fix · GHSA-5wcm-3v2w-8362 laravel/framework (Packagist) Fixed in 13.27.0 Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114508
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-23 Alias added: GHSA-5wcm-3v2w-8362
  4. 2026-10-23 Fix available: Packagist/laravel/[email protected], Packagist/laravel/[email protected] · GHSA-5wcm-3v2w-8362
  5. 2026-10-23 CVSS score added · GHSA-5wcm-3v2w-8362
  6. 2026-10-23 Weakness changed · GHSA-5wcm-3v2w-8362
  7. 2026-10-23 9 new references · GHSA-5wcm-3v2w-8362
  8. 2026-10-24 CISA SSVC decision points changed

References

Advisory 1

Other 8

  • TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33912 Livewire vulnerable to remote command execution during property update hydration KEVCVSS 4.0CRITICAL 9.2
  • TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
  • TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
  • TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences