CVE-2026-88027: Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using the MongoDB integration for Laravel are exposed where authenticated users can influence an embedded-document record identifier used by embedded-document relation handling. The issue requires low-privileged authenticated access; it is not described as exploitable by unauthenticated users.
What could an attacker do after exploiting it?
An attacker may cause the supplied identifier to be treated as a query condition instead of a literal value. This can delete all embedded documents in a targeted record or overwrite an embedded document other than the intended one.
What attacker access and conditions are required?
The attacker must be authenticated and able to control an embedded record identifier processed by the affected relation handling. No user interaction is required, and the attack can be performed over the network.