CVE-2026-118510
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
- Score
- CVSS 3.1 8.8 High
- Status
- Received - cna@mongodb.com
- Published
- 2026-10-28
- Last modified
- 2026-10-28
- Weaknesses
- CWE-843
Affected products
References
- https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0
- https://jira.mongodb.org/browse/PHPLARA-148
