GHSA-5wcm-3v2w-8362 - Laravel relationship inclusion can trigger unauthorized data destruction
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
### Impact
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
MEDIUM
Severity & confidence
Source severitymedium
Platform severitymedium
Confidencehigh
Exploitationunknown
CVSS6.5
Affected
Vendorslaravel
Productslaravel/framework
Reporting sources (2)
GitHub Security Advisories
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-23T21:47:48
Last updated2026-10-27T17:01:23
Ingested2026-10-23T22:03:29
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: vendor ยท Original: GitHub Security Advisories