CVE-2026-114508

Katalog CVE

CVSS 6.5 · Medium EPSS 0,31%

Kerentanan Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'). Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Bypass Autentikasi TokenGuard pada Laravel (CVE-2026-114509) dan Penghapusan Data Tanpa Izin (CVE-2026-114508) 24 Okt 2026

Rincian

Terbit di NVD

21 Oktober 2026

Terakhir diubah

23 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/laravel/framework/commit/50a7970efe9f9990b6ec4f1e949de2abaaf4263e
• https://github.com/laravel/framework/commit/b89f2944995d555bfda76dced1ef6c6b04ef17d8
• https://github.com/laravel/framework/pull/61322
• https://github.com/laravel/framework/pull/61323
• https://github.com/laravel/framework/releases/tag/v12.68.0
• https://github.com/laravel/framework/releases/tag/v13.27.0
• https://github.com/laravel/framework/security/advisories/GHSA-5wcm-3v2w-8362