Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe

Medium · 6.4 Laravel CVE-2026-114508 GHSA-5wcm-3v2w-8362 PKSA-4hy6-m98j-dz9f CVE-2026-114509

Laravel Fixes Data-Destruction Bug and Critical Authentication Bypass in TokenGuard

Two vulnerabilities in laravel/framework have been fixed: one allows read-only users to trigger destructive database operations on related tables (CVE-2026-114508), the other allows unauthenticated attackers to bypass TokenGuard authentication under certain MySQL/MariaDB configurations (CVE-2026-114509).

Synthesized by AI from 8 sources · updated 2 hours ago
Sources · merged by AI 8 total

AI summary

Two security advisories affecting the laravel/framework package have been published and fixed. The first, CVE-2026-114508, involves a flaw where crafted relationship inclusion on a read-only endpoint can trigger destructive database operations instead of simple data retrieval. The second, CVE-2026-114509, is a more severe authentication bypass in Laravel's TokenGuard that can allow an unauthenticated attacker to take over accounts under specific database configurations. Both issues have been addressed by the Laravel project with available fixed versions.

What Happened

Two distinct vulnerabilities were identified in laravel/framework. CVE-2026-114508 (GHSA-5wcm-3v2w-8362) describes a case where crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data, rather than the expected read behavior. CVE-2026-114509 (GHSA-f9x3-7vq9-cph6) describes a case where TokenGuard, when configured as a standard token-based API guard, fails to reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, this can cause the authentication lookup to match an unintended existing user.

Technical Cause

CVE-2026-114508 is classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code / Unsafe Reflection), where input controlling relationship inclusion is not properly validated before being used in a destructive database operation. CVE-2026-114509 is classified under CWE-287 (Improper Authentication); TokenGuard does not enforce that submitted credentials are strings, and under certain MySQL or MariaDB type-coercion behaviors, a non-string credential can match an unintended user record during the authentication lookup.

Why It Matters

CVE-2026-114508 allows a user with only read access, and no write permission, to cause irreversible data loss on related tables, resulting in denial of service and loss of data integrity. CVE-2026-114509 is more severe: it allows an unauthenticated attacker to bypass authentication entirely and take over an account on routes protected by TokenGuard, provided the affected database configuration is in use. This can lead to full account compromise without any prior credentials.

Who Is Affected

Applications using laravel/framework that expose read-only endpoints supporting relationship inclusion are affected by CVE-2026-114508. Applications using TokenGuard as a standard token-based API guard, running on MySQL or MariaDB configurations affected by the described type-coercion behavior, are affected by CVE-2026-114509. Not all deployments use TokenGuard or the affected database configurations, so applicability should be verified per application.

Affected Versions

CVE-2026-114508 affects laravel/framework from version 12.45.0 until 12.68.0, and version 13.27.0, with the fix released in 12.68.0 and 13.27.0. CVE-2026-114509 affects laravel/framework prior to 12.68.0 and 13.29.0, with the fix released in 12.68.0 and 13.29.0. Note that source advisories differ slightly in how the 13.x range is expressed (some list the introduced version as 0, others as 13.0.0); the fixed versions are consistent across sources.

Fixes and Mitigation

Both issues are fixed by the Laravel project. CVE-2026-114508 is resolved in versions 12.68.0 and 13.27.0. CVE-2026-114509 is resolved in versions 12.68.0 and 13.29.0. Applications should upgrade to the fixed versions appropriate to their Laravel release line.

Recommended Action

Site owners and developers running laravel/framework should upgrade to the fixed versions as soon as possible: 12.68.0 or 13.27.0 for CVE-2026-114508, and 12.68.0 or 13.29.0 for CVE-2026-114509. Given that CVE-2026-114509 allows unauthenticated account takeover under certain database configurations, applications using TokenGuard with MySQL or MariaDB should prioritize this update.

PatchBriefing score

6.4 / 10 · Medium

Official CVSS: 9.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS 0.0040 (33 percentile)

Why this score

CVE-2026-114508 has a CVSS base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting network-exploitable, low-complexity access with no privileges or user interaction required, but limited impact restricted to integrity and availability loss on related data. Its PatchBriefing score of 4.9 reflects this moderate impact combined with the absence of known exploitation, no public exploit, and a low EPSS score (0.00306). CVE-2026-114509 has a much higher CVSS base score of 9.2, reflecting high impact to confidentiality, integrity, and availability through full authentication bypass with no privileges or user interaction required. Its PatchBriefing score of 6.4 is driven primarily by this high CVSS base score, with additional contributions from the unauthenticated, remote, no-interaction nature of the flaw and the popularity of the affected product. Neither vulnerability is currently known to be exploited in the wild, and no public exploit code has been reported for either.

Affected versions

laravel/framework >= 13.0.0, < 13.27.0
vulnerable
laravel/framework >=13.0.0,<13.27.0|>=12.45.0,<12.68.0
vulnerable
laravel/framework ≥ 13.0.0 < 13.27.0
vulnerable
laravel/framework
vulnerable
≥ 12.68.0
patched
≥ 13.27.0
patched
laravel/framework < 12.68.0
vulnerable
laravel/framework ≥ 0 < 12.68.0
vulnerable
laravel/framework
vulnerable
laravel/framework <12.68.0|>=13.0.0,<13.29.0
vulnerable
≥ 12.68.0
patched
≥ 13.29.0
patched

Reported fixes

Both issues are fixed by the Laravel project. CVE-2026-114508 is resolved in versions 12.68.0 and 13.27.0. CVE-2026-114509 is resolved in versions 12.68.0 and 13.29.0. Applications should upgrade to the fixed versions appropriate to their Laravel release line.

How this was built

8 source records were collected, matched and used to prepare the report above.

  • NVD (NIST) database
  • GitHub Advisory Database database
  • Packagist Security Advisories registry
  • OSV.dev database
  • NVD (NIST) database
  • GitHub Advisory Database database
Unified report
Laravel Fixes Data-Destruction Bug and Critical Authentication Bypass in TokenGuard
1 article · 8 sources cited
Revision history
  1. Published
  2. Generated
MED 4.2 Laravel 24 Oct Livewire Authorization Bypass Lets Users Act on Records They Don't Own Livewire versions 4.3.0 up to 4.4.8 contain an authorization bypass in the #[Authorize] attribute, allowing authenticated users to trigger actions against records they do not own. Fixed in 4.4.8. Read full report → MED 6.0 Laravel 30 Sep league/commonmark: Quadratic-Time Denial of Service in GFM Table Extension (CVE-2026-105830) A denial-of-service flaw in league/commonmark's GitHub Flavored Markdown Table extension allows unauthenticated attackers to exhaust CPU resources by submitting crafted Markdown input. Fixed in version 2.10.2. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email