Security advisoryCVE-2026-114508

Laravel relationship inclusion can trigger unauthorized data destruction

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. ### Impact A user with only read access could cause irrev…

Moderate6.5Published Oct 23, 2026Modified Oct 23, 2026Original advisory

As published by the sources

Affected packages

laravel/framework
Affected>=12.45.0,<12.68.0 || >=13.0.0,<13.27.0
Fixed in12.68.013.27.0

Derived from the fixed versions above

What to do

1
Upgrade laravel/framework to the fixed version in your release line: 12.68.0, 13.27.0.
```
composer update laravel/framework --with-dependencies
```

To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.

Quoted from the original advisory

Details

Impact

A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.