- Package
- laravel/framework
- Fixed in
- 12.68.0, 13.27.0
- Published
- Fri 23 Oct 2026, 22:47 Lisbon
- Installs on Packagist
- 604M
In plain words
A user with only read access could cause irreversible data loss through relationship inclusion on certain read-only endpoints, without needing write permissions. Under specific conditions, a request can trigger a destructive database operation on a related table instead of retrieving data. This could leave a related table empty and cause denial of service or loss of data integrity.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| laravel/framework | >= 12.45.0, < 12.68.0 | 12.68.0 |
| laravel/framework | >= 13.0.0, < 13.27.0 | 13.27.0 |
Am I affected?
Check the laravel/framework version in composer.lock. Affected versions are >= 12.45.0, < 12.68.0 and >= 13.0.0, < 13.27.0; the fixes are 12.68.0 and 13.27.0. Review whether your application processes relationship inclusion on read-only endpoints. The description does not identify the specific endpoint conditions or name a database type, so it does not provide enough detail to rule out exposure from configuration alone.
What to do
Check which version you have, then update to a fixed release for your branch (12.68.0, 13.27.0):
composer show laravel/framework | grep versions
composer update laravel/frameworkIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
Weakness: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). Reported by KIKOmanasijev.
The advisory
- GitHub Advisory Database: GHSA-5wcm-3v2w-8362, with who is affected and how
- OSV.dev: GHSA-5wcm-3v2w-8362
- The week's digest, with the other advisories from 19 Oct 2026
- All advisories for laravel/framework