What’s Vulnerable › Vulnerabilities

CVE-2026-118510: Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-28 · updated 2026-10-29
• Weakness: CWE-843

Description

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

Affected products

• MongoDB Laravel MongoDB (PHP): from 3.2.3 before 5.12.0 — fixed in 5.12.0

How to fix

Upgrade to a fixed version: MongoDB Laravel MongoDB (PHP) 5.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0
• https://jira.mongodb.org/browse/PHPLARA-148

Get alerted when CVE-2026-118510 or the next vulnerability affects your stack