8.8
HighCVSS 3.1 · from mongodb
CVE-2026-118510
Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
mongodb/laravel-mongodb · CWE-843 · CWE-843Affectedmongodb/laravel-mongodb
FixUpdate to 5.12.0 or newer
PublishedOct 28, 16:15 · mongodb
ScoredOct 28 · 8.8 · mongodb
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
From mongodb
Affected and fixed versions
ProductAffectedFixed inmongodb/laravel-mongodb3.2.3 – before 5.12.05.12.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known