CVE-2026-114508mediumCWE-470

CVE-2026-114508: medium-severity vulnerability in laravel framework

Laravel relationship inclusion can trigger unauthorized data destruction

Published · Updated

Follow this CVE+ Monitor framework+ Monitor laravel/framework

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
laravel · framework
Related CVEs — laravel framework

In the same product, most dangerous first.

CVE-2024-52301HIGHLaravel allows environment manipulation via query stringEPSS 44.8%CVE-2021-21263HIGHQuery Binding Exploitation in LaravelEPSS 1.6%CVE-2021-43808MEDIUMBlade `@parent` Exploitation Leading To Possible XSS in LaravelEPSS 0.8%CVE-2026-114509CRITICALLaravel TokenGuard authentication bypass through non-string API credentialsEPSS 0.8%CVE-2025-27515MEDIUMLaravel has a File Validation BypassEPSS 0.7%CVE-2026-48019HIGHCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayEPSS 0.5%