{"id":"ghsa-ghsa-5wcm-3v2w-8362","seq":661311,"kind":"advisory","title":"Laravel relationship inclusion can trigger unauthorized data destruction","url":"https://github.com/advisories/GHSA-5wcm-3v2w-8362","permalink":"https://vulnpulse.app/items/ghsa-ghsa-5wcm-3v2w-8362","summary":"影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0\nA vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…","severity":"medium","techs":["php","laravel"],"cves":["CVE-2026-114508"],"tags":["GHSA-5wcm-3v2w-8362","laravel/framework","laravel/framework"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:47:48.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}