CVE-2026-114508 — Vulnerability intelligence
PHP / Composer — laravel/framework, laravel/framework
Published:
- CVSS
- 6.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Laravel relationship inclusion can trigger unauthorized data destruction
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
### Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.