CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114508?
CVE-2026-114508 is a medium-severity vulnerability in laravel framework, published on 21 Oct 2026.
Official description
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Weakness: CWE-470
Which versions are affected by CVE-2026-114508?
4 open source packages ship an affected version, including laravel/framework.
| Package | Affected | Fixed in |
|---|---|---|
laravel/framework Packagist | From 12.45.0 | 12.68.0 |
laravel/framework Packagist | From 12.45.0 | 12.68.0 |
laravel/framework Packagist | From 13.0.0 | 13.27.0 |
laravel/framework Packagist | From 13.0.0 | 13.27.0 |
How do I fix CVE-2026-114508?
Upgrade laravel/framework to a fixed version for your release line: 12.68.0 or 13.27.0.
Is CVE-2026-114508 being exploited?
There is no known exploitation of CVE-2026-114508 in the wild and no public exploit code.
Sources
Also known as GHSA-5wcm-3v2w-8362.