Laravel relationship inclusion can trigger unauthorized data destruction
Published 23 Oct 2026 · Updated 23 Oct 2026
Affected packages
- Affected
- >=12.45.0 <12.68.0
- Fixed in
- 12.68.0
composer require laravel/framework:^12.68.0- Affected
- >=13.0.0 <13.27.0
- Fixed in
- 13.27.0
composer require laravel/framework:^13.27.0Details
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
Is GHSA-5wcm-3v2w-8362 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected laravel/framework, and gives you the command that fixes it.
References
- Linkgithub.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-114508
- Linkgithub.com/laravel/framework/pull/61322
- Linkgithub.com/laravel/framework/pull/61323
- Linkgithub.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
- Linkgithub.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
- Packagegithub.com/laravel/framework
- Linkgithub.com/laravel/framework/releases/tag/v12.68.0
- Linkgithub.com/laravel/framework/releases/tag/v13.27.0
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.