Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-114508 · GHSA-5wcm-3v2w-8362

Laravel relationship inclusion can trigger unauthorized data destruction

Risk score
48/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
21 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreve…
Affected
laravel/framework (composer) >= 12.45.0, < 12.68.0; laravel/framework (composer) >= 13.0.0, < 13.27.0
Fix
Upgrade laravel/framework to 12.68.0 or 13.27.0 (whichever matches your release line) or later.
Exploitation
No known exploitation

Story map

Story map: laravel/frameworkTHE FLAWSTHE FIXCVE-2026-114508Laravel relationship inclusioncan trigger unauthorized datadestructionCVSS 6.5 · EPSS 0%CVE-2026-114509Laravel TokenGuardauthentication bypass throughnon-string API credentialsCVSS 9.2 · EPSS 0%Upgrade laravel/framework12.68.0 · 13.27.0 · 13.29.0or later on your release lineWho is exposed{'products': ['Laravel'],'packages': [{'name':'laravel/framework','vulnerable': '>= 13.0.0, <13.29.0', 'patched': '13.29.0'}…AMBER · PATCH THIS WEEKlaravel/frameworkLaravel's TokenGuardauthentication bypassvulnerability allows an attackerto bypass authentication andtake over an account on routesprotected by TokenGuard. This isdue to a crafted non-string…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-470 (CWE-470)26 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

laravel/framework: Amber, patch this week. Laravel's TokenGuard authentication bypass vulnerability allows an attacker to bypass authentication and take over an account on routes protected by TokenGuard. This is due to a crafted non-string credential not being rejected by TokenGuard.

The flaws

  • CVE-2026-114508: Laravel relationship inclusion can trigger unauthorized data destruction (CVSS 6.5 · EPSS 0%)
  • CVE-2026-114509: Laravel TokenGuard authentication bypass through non-string API credentials (CVSS 9.2 · EPSS 0%)

The fix

Upgrade laravel/framework: 12.68.0 · 13.27.0 · 13.29.0 or later on your release line

Who is exposed: {'products': ['Laravel'], 'packages': [{'name': 'laravel/framework', 'vulnerable': '>= 13.0.0, < 13.29.0', 'patched': '13.29.0'}, {'name': 'laravel/framework', 'vulnerable': '< 12.68.0', 'patched': '12.68.0'}], 'versions': ['12.68.0', '13.29.0']}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: Composer

Affected packages

PackageEcosystemVulnerableFixed in
laravel/frameworkcomposer>= 12.45.0, < 12.68.012.68.0
laravel/frameworkcomposer>= 13.0.0, < 13.27.013.27.0

References

Original description

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Last activity 23 Oct 2026. Patch Forecast updates every hour.