CVE-2026-114508

Name	CVE-2026-114508
Description	Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-laravel-framework (PTS)	bookworm	8.83.26+dfsg-2	vulnerable
	trixie	10.48.29+dfsg-1	vulnerable
	forky	13.31.0+dfsg-1	fixed
	sid	13.31.0+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-laravel-framework	source	(unstable)	13.31.0+dfsg-1

Notes

https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
https://github.com/laravel/framework/pull/61322
Fixed by: https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8 (v13.27.0)
https://github.com/laravel/framework/pull/61323
Fixed by: https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e (v12.68.0)