Vulnerability · Published Sep 10, 2026 · Assigned by mongodb
CVE-2026-88027Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel
High 7.1
In plain English
A high-severity security flaw in Laravel MongoDB (PHP) from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | Laravel MongoDB (PHP) | 4.0.0 – before 5.11.0 |
Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L