Vulnerability advisory

GHSA-5wcm-3v2w-8362

Laravel relationship inclusion can trigger unauthorized data destruction

Published Oct 23, 2026Updated Oct 23, 2026OSV record ↗

Also known as CVE-2026-114508

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected versions

laravel/framework Packagist

All laravel/framework advisories →

Affected	Fixed in
`12.45.0` to before 12.68.0	`12.68.0`Advisories →
Also listed as affected (31) `v12.45.0` `v12.45.1` `v12.45.2` `v12.46.0` `v12.47.0` `v12.48.0` `v12.48.1` `v12.49.0` `v12.50.0` `v12.51.0` `v12.52.0` `v12.53.0` `v12.54.0` `v12.54.1` `v12.55.0` `v12.55.1` `v12.56.0` `v12.57.0` `v12.58.0` `v12.59.0` `v12.60.0` `v12.60.1` `v12.60.2` `v12.61.0` `v12.61.1` `v12.62.0` `v12.63.0` `v12.64.0` `v12.65.0` `v12.66.0` `v12.67.0`
`13.0.0` to before 13.27.0	`13.27.0`Advisories →
Also listed as affected (34) `v13.0.0` `v13.1.0` `v13.1.1` `v13.10.0` `v13.11.0` `v13.11.1` `v13.11.2` `v13.12.0` `v13.13.0` `v13.14.0` `v13.15.0` `v13.16.0` `v13.16.1` `v13.17.0` `v13.18.0` `v13.18.1` `v13.19.0` `v13.2.0` `v13.20.0` `v13.21.0` `v13.21.1` `v13.22.0` `v13.23.0` `v13.24.0` `v13.25.0` `v13.26.0` `v13.26.1` `v13.3.0` `v13.4.0` `v13.5.0` `v13.6.0` `v13.7.0` `v13.8.0` `v13.9.0`

Description

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

Impact

A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

GHSA-5wcm-3v2w-8362

Affected versions

laravel/framework Packagist

Description

Impact

References