CVE-2026-114508: Laravel relationship inclusion can trigger unauthorized data destruction
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
References
- github.com/advisories/GHSA-5wcm-3v2w-8362
- github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
- github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
- github.com/laravel/framework/pull/61322
- github.com/laravel/framework/pull/61323
- github.com/laravel/framework/releases/tag/v12.68.0
- github.com/laravel/framework/releases/tag/v13.27.0
- github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
- nvd.nist.gov/vuln/detail/CVE-2026-114508
Code Behaviors & Features
Detect and mitigate CVE-2026-114508 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →