HIGH 7.7 NVD
CVE-2026-118510
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
References
- https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0
- https://jira.mongodb.org/browse/PHPLARA-148
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-10-28 via NVD.
vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.