CVE-2026-88027highCWE-943

CVE-2026-88027: falha de alta gravidade em MongoDB Laravel MongoDB (PHP)

Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

Publicada em

Seguir esta CVE+ Monitorar Laravel MongoDB

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · Laravel MongoDB (PHP)
CVEs relacionadas — MongoDB Laravel MongoDB (PHP)

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88022HIGHUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelEPSS 0.4%CVE-2026-88028HIGHUnauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for LaravelEPSS 0.4%CVE-2026-96744HIGHUnauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for LaravelEPSS 0.3%