# CVE-2026-114508: Laravel privilege escalation in read-only endpoints

Source: https://junglewise.ai/threats/cve-2026-114508-laravel-is-a-web-application-framework-from-12-45-0-until-12-68  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114508 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Laravel is a popular web application framework used to build web applications. A vulnerability allows users with read-only access to craft malicious requests that trigger destructive database operations on related tables, resulting in irreversible data loss and potential denial of service. An attacker with limited permissions can delete data they should not have access to, compromising data integrity and application availability.

Technologies: [laravel/framework (Packagist)](https://junglewise.ai/threats/technologies/packagist-laravel-framework). Vendors: [Laravel](https://junglewise.ai/threats/vendors/laravel), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-114508 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114508 being exploited in the wild.

**How severe is CVE-2026-114508?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** Laravel Framework 12.45.0 through 12.68.0, 13.0 through 13.27.0; laravel/framework (Packagist) >= 12.45.0, < 12.68.0, ECOSYSTEM:introduced=12.45.0,fixed=12.68.0.

**Is there a fix for CVE-2026-114508?** Yes. laravel/framework (Packagist): upgrade to 12.68.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114508 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114508?** Check whether you run Laravel Framework or laravel/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- laravel/framework (Packagist): upgrade to 12.68.0 or later

  ```sh
  composer require laravel/framework:^12.68.0
  ```


## Technical details

The vulnerability exists in Laravel's JSON:API resource loading mechanism between versions 12.45.0–12.68.0 and 13.0–13.27.0. A crafted relationship inclusion request on a read-only endpoint can be manipulated to execute write operations (such as deletion) on related tables. The attack requires only read-level database permissions and no additional user interaction, allowing privilege escalation from read to write access.

## Affected products

- Laravel Framework 12.45.0 through 12.68.0, 13.0 through 13.27.0

## Identifiers

- CVE-2026-114508
- GHSA-5wcm-3v2w-8362

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e](https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e)
- [https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8](https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8)

## Related threats

- [Laravel TokenGuard authentication bypass via non-string credential](https://junglewise.ai/threats/cve-2026-114509-laravel-is-a-web-application-framework-prior-to-12-68-0-and-13)
- [Laravel: XSS in Debug Page Information](https://junglewise.ai/threats/cve-2026-102279-laravel-is-a-web-application-framework-prior-to-12-69-0-and-13)
- [Laravel CRLF injection in email validation](https://junglewise.ai/threats/cve-2026-48019-laravel-crlf-injection-in-email-validation)
- [Laravel framework susceptible to reflected cross-site scripting](https://junglewise.ai/threats/cve-2024-13918-laravel-framework-susceptible-to-reflected-cross-site-scripting)
- [Laravel framework susceptible to reflected cross-site scripting](https://junglewise.ai/threats/cve-2024-13919-laravel-framework-susceptible-to-reflected-cross-site-scripting)