CVE-2026-88028: Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.
Affected Software
Event History
Frequently Asked Questions
Can exploitation be performed remotely without victim interaction?
The attack vector is network-based and does not require user interaction. The attacker must still be authenticated and able to influence a stored polymorphic relation identifier.
What level of access does an attacker need?
The vulnerability is rated as requiring low privileges. In practice, the attacker needs an authenticated application account with a way to affect the stored relation identifier used by the affected MongoDB relation handling.
Does this issue affect data integrity or service availability?
The provided vector rates confidentiality impact as high, while integrity and availability impacts are none. The stated outcome is unintended disclosure of a document rather than modification or disruption.