Laravel relationship inclusion can trigger unauthorized data destruction

影響: composer:laravel/framework >= 12.45.0, < 12.68.0 → 12.68.0, composer:laravel/framework >= 13.0.0, < 13.27.0 → 13.27.0

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applicati…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 06:47, GitHub Advisory Database에서 "Laravel relationship inclusion can trigger unauthorized data destruction"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: PHP, Laravel. CVE: CVE-2026-114508.