PKSA-4hy6-m98j-dz9f: Laravel relationship inclusion can trigger unauthorized data destruction
Published Oct 23, 2026
·Updated
Laravel relationship inclusion can trigger unauthorized data destruction
Affected Software
2 affected componentsFixes available
composer/laravel/framework>=13.0.0, <13.27.0
13.27.0
composer/laravel/framework>=12.45.0, <12.68.0
12.68.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/laravel/frameworkto a version that resolves this vulnerability.Fixed in 13.27.0 - Upgrade
Upgrade
composer/laravel/frameworkto a version that resolves this vulnerability.Fixed in 12.68.0
Event History
Oct 23, 2026
Advisory Published
via Packagist·09:47 PM
Data Sourced
via Packagist·09:47 PM
DescriptionSeverityAffected Software