CVE-2026-114508 laravel CVE debrief

Who should care

Defenders responsible for applications using Laravel framework versions between 12.45.0 and 12.68.0 or between 13.0.0 and 13.27.0 should assess exposure and apply patches to prevent data loss and service disruption.

Why it matters

Defenders should care about CVE-2026-114508 because it allows unauthorized data destruction and denial of service in Laravel applications, requiring verification of exposure and prompt patching.

• Potential data loss due to destructive database operations.
• Denial of service for affected applications.
• Loss of data integrity for affected applications.
• Need for verification of exposure and application of patches.

Technical summary

The vulnerability in Laravel's relationship inclusion processing allows a crafted request to a read-only endpoint to trigger a destructive database operation on a related table, leading to irreversible data loss. This occurs in Laravel framework versions between 12.45.0 and 12.68.0 or between 13.0.0 and 13.27.0. The vulnerability can be mitigated by applying patches in versions 12.68.0 and 13.27.0. Defenders should prioritize verifying exposure, assessing affected applications, and applying patches to prevent data loss and service disruption.

Defensive priority

Defenders should prioritize verifying exposure, assessing affected applications, and applying patches to prevent data loss and service disruption.

Recommended defensive actions

• Verify if applications using Laravel framework versions between 12.45.0 and 12.68.0 or between 13.0.0 and 13.27.0 are exposed.
• Assess the potential impact of data loss and denial of service for affected applications.
• Apply patches to upgrade to Laravel framework version 12.68.0 or 13.27.0.
• Monitor for suspicious activity that could indicate exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Laravel framework versions between 12.45.0 and 12.68.0 and between 13.0.0 and 13.27.0. Official patches are available in versions 12.68.0 and 13.27.0. Evidence is based on source item provided by osv_dev. The source details are limited, so defenders should verify exposure and apply patches cautiously. Additional verification steps are recommended to ensure the absence of exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.