Most recent entries from all

fkie_cve-2026-114508

2026-10-24T03:11:14.329952+00:00

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

GHSA-5wcm-3v2w-8362 — Laravel relationship inclusion can trigger unauthorized data destruction

2026-10-24T03:11:14.330057+00:00

Affected: Packagist: laravel/framework

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

### Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

WID-SEC-W-2026-4046 — Laravel: Mehrere Schwachstellen

2026-10-24T03:11:14.330109+00:00

Ein Angreifer kann mehrere Schwachstellen in Laravel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.