Vulnerability GHSA-5wcm-3v2w-8362
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
18 days ago
October 23, 2026 at 09:47 PM UTC
Laravel relationship inclusion can trigger unauthorized data destruction
12.45.0 - 12.67.0 and 13.0.0 - 13.26.1
12.45.0 - 12.67.0 and 13.0.0 - 13.26.1
Summary
Laravel relationship inclusion can trigger unauthorized data destruction
Details
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
18 days ago
Laravel TokenGuard authentication bypass through non-string API credentials
4.0.0-BETA2 - 10.50.3 and 11.0.0 - 11.56.0 and 12.0.0 - 12.67.0 and 13.0.0 - 13.26.1 GHSA-f9x3-7vq9-cph6
4.0.0-BETA2 - 10.50.3 and 11.0.0 - 11.56.0 and 12.0.0 - 12.67.0 and 13.0.0 - 13.26.1 GHSA-f9x3-7vq9-cph6
Low Risk
1 month ago
Laravel: XSS in Debug Page Information
4.0.0-BETA2 - 12.68.0 and 13.0.0 - 13.29.0 GHSA-jh5r-qr3c-85q8
4.0.0-BETA2 - 12.68.0 and 13.0.0 - 13.29.0 GHSA-jh5r-qr3c-85q8
Medium Risk
4 months ago
Laravel Framework: Temporary Signed URL Path Confusion
4.0.0-BETA2 - 12.61.0 and 13.0.0 - 13.11.2 GHSA-crmm-hgp2-wgrp
4.0.0-BETA2 - 12.61.0 and 13.0.0 - 13.11.2 GHSA-crmm-hgp2-wgrp
High Risk
4 months ago
Laravel Framework: CRLF injection in default email rule
4.0.0-BETA2 - 12.59.0 and 13.0.0 - 13.9.0 GHSA-5vg9-5847-vvmq
4.0.0-BETA2 - 12.59.0 and 13.0.0 - 13.9.0 GHSA-5vg9-5847-vvmq
Medium Risk
1 year ago
Laravel framework susceptible to reflected cross-site scripting
11.9.0 - 11.35.1 GHSA-546h-56qp-8jmw
11.9.0 - 11.35.1 GHSA-546h-56qp-8jmw
Impacted packages
Timeline
Published
18 days ago
October 23, 2026 at 09:47 PM UTC
Fixed (13.27.0)
2 months ago
August 25, 2026 at 02:16 PM UTC
Fixed (12.68.0)
2 months ago
August 25, 2026 at 02:18 PM UTC
Last Modified
18 days ago
October 23, 2026 at 10:00 PM UTC