Is CVE-2026-114508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114508 being exploited in the wild.

How severe is CVE-2026-114508?

Medium severity, with a CVSS score of 6.5, published 21 October 2026.

Which products and versions are affected?

Laravel Framework 12.45.0 through 12.68.0, 13.0 through 13.27.0; laravel/framework (Packagist) >= 12.45.0, < 12.68.0, ECOSYSTEM:introduced=12.45.0,fixed=12.68.0.

Is there a fix for CVE-2026-114508?

Yes. laravel/framework (Packagist): upgrade to 12.68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114508 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114508?

Check whether you run Laravel Framework or laravel/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114508: Laravel privilege escalation in read-only endpoints

Q: Is there a fix for CVE-2026-114508?

Yes. laravel/framework (Packagist): upgrade to 12.68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114508 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114508?

Check whether you run Laravel Framework or laravel/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114508 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Laravel is a popular web application framework used to build web applications. A vulnerability allows users with read-only access to craft malicious requests that trigger destructive database operations on related tables, resulting in irreversible data loss and potential denial of service. An attacker with limited permissions can delete data they should not have access to, compromising data integrity and application availability.

Technologies: laravel/framework (Packagist). Vendors: Laravel, Packagist.

Quick answers

Is CVE-2026-114508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114508 being exploited in the wild.
How severe is CVE-2026-114508?: Medium severity, with a CVSS score of 6.5, published 21 October 2026.
Which products and versions are affected?: Laravel Framework 12.45.0 through 12.68.0, 13.0 through 13.27.0; laravel/framework (Packagist) >= 12.45.0, < 12.68.0, ECOSYSTEM:introduced=12.45.0,fixed=12.68.0.
Is there a fix for CVE-2026-114508?: Yes. laravel/framework (Packagist): upgrade to 12.68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114508 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114508?: Check whether you run Laravel Framework or laravel/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

laravel/framework (Packagist): upgrade to 12.68.0 or later
```
composer require laravel/framework:^12.68.0
```

Technical details

The vulnerability exists in Laravel's JSON:API resource loading mechanism between versions 12.45.0–12.68.0 and 13.0–13.27.0. A crafted relationship inclusion request on a read-only endpoint can be manipulated to execute write operations (such as deletion) on related tables. The attack requires only read-level database permissions and no additional user interaction, allowing privilege escalation from read to write access.

Affected products

Laravel Framework 12.45.0 through 12.68.0, 13.0 through 13.27.0

Identifiers

CVE-2026-114508
GHSA-5wcm-3v2w-8362

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.