CVE-2026-114508

Name of the Vulnerable Software and Affected Versions Laravel versions 12.45.0 through 12.67.0 Laravel version 13.26.0 and earlier

Description A crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. This allows a user with read access but no write permissions to empty data from related tables, leading to irreversible data loss, denial of service, and loss of data integrity.

Recommendations Update to version 12.68.0. Update to version 13.27.0.