GHSA-5wcm-3v2w-8362

Suggest an improvement
Source
https://github.com/advisories/GHSA-5wcm-3v2w-8362
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wcm-3v2w-8362/GHSA-5wcm-3v2w-8362.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-5wcm-3v2w-8362
Aliases
Published
2026-10-23T21:47:48Z
Modified
2026-10-23T22:00:03Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Laravel relationship inclusion can trigger unauthorized data destruction
Details

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

Impact

A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

Database specific 
{
    "cwe_ids": [
        "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-23T21:47:48Z",
    "nvd_published_at": "2026-10-21T22:16:49Z",
    "severity": "MODERATE"
}
References

Affected packages

Packagist / laravel/framework

Package

Name
laravel/framework
Purl
pkg:composer/laravel/framework

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.45.0
Fixed
12.68.0

Affected versions

v12.*
v12.45.0
v12.45.1
v12.45.2
v12.46.0
v12.47.0
v12.48.0
v12.48.1
v12.49.0
v12.50.0
v12.51.0
v12.52.0
v12.53.0
v12.54.0
v12.54.1
v12.55.0
v12.55.1
v12.56.0
v12.57.0
v12.58.0
v12.59.0
v12.60.0
v12.60.1
v12.60.2
v12.61.0
v12.61.1
v12.62.0
v12.63.0
v12.64.0
v12.65.0
v12.66.0
v12.67.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wcm-3v2w-8362/GHSA-5wcm-3v2w-8362.json"

Packagist / laravel/framework

Package

Name
laravel/framework
Purl
pkg:composer/laravel/framework

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.0.0
Fixed
13.27.0

Affected versions

v13.*
v13.0.0
v13.1.0
v13.1.1
v13.2.0
v13.3.0
v13.4.0
v13.5.0
v13.6.0
v13.7.0
v13.8.0
v13.9.0
v13.10.0
v13.11.0
v13.11.1
v13.11.2
v13.12.0
v13.13.0
v13.14.0
v13.15.0
v13.16.0
v13.16.1
v13.17.0
v13.18.0
v13.18.1
v13.19.0
v13.20.0
v13.21.0
v13.21.1
v13.22.0
v13.23.0
v13.24.0
v13.25.0
v13.26.0
v13.26.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5wcm-3v2w-8362/GHSA-5wcm-3v2w-8362.json"