GHSA-5wcm-3v2w-8362: Medium severity composer/laravel/framework vulnerability

Q: Can a user limited to read access exploit this issue?

Yes. A user with only read access can trigger the destructive operation and does not need write permissions.

Q: What conditions are required for exploitation?

The attacker must be able to send a crafted request to an affected read-only endpoint that processes relationship inclusion. No user interaction is required.

Q: What is the operational impact of successful exploitation?

The issue can cause irreversible loss of data in a related database table, including a table being emptied. This can affect data integrity and cause denial of service for the application.

Published Oct 23, 2026

Updated

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

Affected Software

2 affected componentsFixes available

composer/laravel/framework>=13.0.0<13.27.0

13.27.0

composer/laravel/framework>=12.45.0<12.68.0

12.68.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/laravel/framework to a version that resolves this vulnerability.
Fixed in 13.27.0
Upgrade
Upgrade composer/laravel/framework to a version that resolves this vulnerability.
Fixed in 12.68.0

Event History

Oct 23, 2026

Advisory Published

via GitHub·09:47 PM

Data Sourced

via GitHub·09:47 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Can a user limited to read access exploit this issue?

Yes. A user with only read access can trigger the destructive operation and does not need write permissions.

What conditions are required for exploitation?

The attacker must be able to send a crafted request to an affected read-only endpoint that processes relationship inclusion. No user interaction is required.

What is the operational impact of successful exploitation?

The issue can cause irreversible loss of data in a related database table, including a table being emptied. This can affect data integrity and cause denial of service for the application.

GHSA-5wcm-3v2w-8362: Medium severity composer/laravel/framework vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Can a user limited to read access exploit this issue?

What conditions are required for exploitation?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Can a user limited to read access exploit this issue?

What conditions are required for exploitation?

What is the operational impact of successful exploitation?