CVE-2026-88027

EUVD-2026-75641

10.09.2026, 18:18

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 17.85%

Affected Products (NVD)

Vendor	Product	Version
mongodb	laravel_mongodb	4.0.0 ≤ 𝑥 < 5.11.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

References

https://jira.mongodb.org/browse/PHPLARA-265