{"id":"CVE-2026-118510","published":"2026-10-28T17:18:26.780","lastModified":"2026-10-28T17:18:26.780","description":"A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-843"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0","tags":[]},{"url":"https://jira.mongodb.org/browse/PHPLARA-148","tags":[]}],"exploitRefs":[{"url":"https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0","tags":[]}],"hasPoc":true,"ai":null}