CVE-2026-88028highCWE-943

CVE-2026-88028: falha de alta gravidade em MongoDB Laravel MongoDB (PHP)

Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel

Publicada em

Seguir esta CVE+ Monitorar Laravel MongoDB

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · Laravel MongoDB (PHP)
CVEs relacionadas — MongoDB Laravel MongoDB (PHP)

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88022HIGHUnauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for LaravelEPSS 0.4%CVE-2026-96744HIGHUnauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for LaravelEPSS 0.3%CVE-2026-88027HIGHMass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for LaravelEPSS 0.3%