Laravel relationship inclusion can trigger unauthorized data destruction

影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…

GitHub Advisory Databaseで読む

2026/10/24 06:47、GitHub Advisory Databaseが「Laravel relationship inclusion can trigger unauthorized data destruction」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: PHP、Laravel。CVE: CVE-2026-114508。