Laravel relationship inclusion can trigger unauthorized data destruction

影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…

Read on GitHub Advisory Database

On 10/24/2026, 06:47 AM, GitHub Advisory Database published "Laravel relationship inclusion can trigger unauthorized data destruction" (type: Advisory). Severity is "Medium" (medium). Related technologies: PHP, Laravel. CVE: CVE-2026-114508.