Skip to content
Heist/ feed
Back to feed
High

Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

Type: advisorySources: Official CVE List

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

Products
Laravel MongoDB
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-118510
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 17:17 UTC · Revision 1

Source evidence

Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

core-cve · Original source

Published 28 Oct 2026, 16:15 UTC

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

cve:CVE-2026-118510

Laravel MongoDB

Fixed versions: Not specified

Complete source record
{
  "id": "e951fb19e744c123b34f35486eb815af1f8d89a8dcf70fddd1f43d896125cf4d",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-118510",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs",
    "summary": "A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.",
    "evidence": "cve:CVE-2026-118510",
    "products": [
      {
        "name": {
          "value": "Laravel MongoDB",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-118510",
      "aliases": [
        "CVE-2026-118510"
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV4_0": {
            "Safety": "NOT_DEFINED",
            "version": "4.0",
            "Recovery": "NOT_DEFINED",
            "baseScore": 7.7,
            "Automatable": "NOT_DEFINED",
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "exploitMaturity": "NOT_DEFINED",
            "providerUrgency": "NOT_DEFINED",
            "userInteraction": "NONE",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "privilegesRequired": "LOW",
            "subIntegrityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "subAvailabilityImpact": "NONE",
            "vulnAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 8.8,
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "integrityImpact": "HIGH",
            "userInteraction": "NONE",
            "attackComplexity": "LOW",
            "availabilityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "confidentialityImpact": "HIGH"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "MongoDB",
          "product": "Laravel MongoDB",
          "versions": [
            {
              "status": "affected",
              "version": "3.2.3",
              "lessThan": "5.12.0",
              "versionType": "semver"
            }
          ],
          "packageName": "mongodb/laravel-mongodb",
          "defaultStatus": "unaffected"
        }
      ],
      "modified": "2026-10-28T16:15:08.426Z",
      "provider": "cve",
      "references": [
        "https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0",
        "https://jira.mongodb.org/browse/PHPLARA-148"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
          "shortName": "mongodb",
          "dateUpdated": "2026-10-28T16:15:08.426Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-118510",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 460282,
  "published_at": "2026-10-28T16:15:08.426+00:00"
}