CVE-2026-118510: Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to meaningful impact?
Applications are exposed when they use this library’s relationship absence check to decide which documents a request may view, modify, or delete, and the relevant identifiers are numeric strings. The issue can cause deny records to be missed silently.
What level of access does an attacker need?
An attacker needs basic privileges. No user interaction is required, and the described impact includes unauthorized reading, modification, or removal of documents that should have been withheld.