| Package | Affected versions | Patched versions |
|---|---|---|
| laravel/framework | ≥ 12.45.0, < 12.68.0≥ 13.0.0, < 13.27.0 | 12.68.013.27.0 |
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.
A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free