Laravel relationship inclusion can trigger unauthorized data destruction
Medium · CVSS 6.5 (GHSA) · fetched 2026-10-23
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. ### Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
Remediation
Upgrade laravel/framework to 12.68.0 or later. Upgrade laravel/framework to 13.27.0 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-23T18:20:12-04:00 · https://github.com/advisories/GHSA-5wcm-3v2w-8362