CVE-2026-114508

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

• CWE-470

• https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
• https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
• https://github.com/laravel/framework/pull/61322
• https://github.com/laravel/framework/pull/61323
• https://github.com/laravel/framework/releases/tag/v12.68.0
• https://github.com/laravel/framework/releases/tag/v13.27.0
• https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362

Published

Oct 21, 2026

Last Modified

Oct 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114491pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAcces…5.3
• CVE-2026-114492gin-vue-admin through 2.9.2 contains a path traversal vulner…6.5
• CVE-2026-114493LocalAI v4.6.0 through v4.11.0 contains a server-side reques…8.6
• CVE-2026-1145A flaw has been found in quickjs-ng quickjs up to 0.11.0. Af…8.8
• CVE-2026-11450A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. Thi…7.3
• CVE-2026-114501Pillow is a Python imaging library. From 11.2.1 until 13.0.0…5.3
• CVE-2026-114509Laravel is a web application framework. Prior to 12.68.0 and…9.2
• CVE-2026-11451A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impac…7.3
• CVE-2026-114510Flexible GraphRAG is a Python framework for building graph a…7.1
• CVE-2026-114515OCO-Server is a self-hosted endpoint management application …6.5
• CVE-2026-114519Missing Authorization (CWE-862) in the user API of Roskus Pr…8.6
• CVE-2026-11452A vulnerability has been found in GL.iNet GL-MT3000 up to 4.…7.3