CVE-2026-96744: Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the MongoDB integration for Laravel are exposed when an authenticated user can influence the owner value used to acquire or restore cache locks. The impact is limited to lock handling, but successful exploitation can cause duplicated or conflicting operations.
What does an attacker need to exploit it?
The attacker needs authentication and the ability to supply or influence the lock owner value used by the application. No user interaction is required, and the vulnerable behavior can be reached over the network.
What can an attacker do after exploitation?
An attacker may take over a lock held by another process or cause that lock to expire prematurely. This can undermine coordination that depends on Laravel cache locks and lead to conflicting execution of protected operations.
How can this be remediated?
Update the MongoDB Laravel integration to the release referenced as 5.11.0. If updating cannot happen immediately, prevent untrusted users from influencing lock owner values and restrict access to workflows that acquire or restore locks.