CVE-2026-114508: Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Laravelto a version that resolves this vulnerability.Fixed in 12.68.0 - Upgrade
Upgrade
Laravelto a version that resolves this vulnerability.Fixed in 13.27.0
Event History
Frequently Asked Questions
Which Laravel releases should be updated?
Update Laravel framework to version 12.68.0 or 13.27.0, which contain the fix. The affected 12.x range begins at 12.45.0 and continues until the fixed 12.68.0 release.
What level of access does an attacker need?
An attacker needs read access to an affected endpoint. Write permission is not required.
What is the practical impact of successful exploitation?
A crafted relationship inclusion can cause data in a related database table to be emptied rather than retrieved. This can result in irreversible data loss, denial of service, and loss of data integrity.