Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity.
This issue is fixed in versions 12.68.0 and 13.27.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
laravel:framework
References 7
https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf…
security-advisories@github.com
https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04e…
security-advisories@github.com
https://github.com/laravel/framework/pull/61322
security-advisories@github.com
https://github.com/laravel/framework/pull/61323
security-advisories@github.com
https://github.com/laravel/framework/releases/tag/v12.68.0
security-advisories@github.com
https://github.com/laravel/framework/releases/tag/v13.27.0
security-advisories@github.com
https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362
security-advisories@github.com