Laravel MongoDB CVE-2026-88022

Exploitation requires all of the following to be true simultaneously: (1) the target application uses the mongodb/laravel-mongodb package; (2) user-controlled input - typically from a parsed JSON request body or a query parameter that PHP coerces into an associative array - is passed without scalar type enforcement to one of where($col, '='|'eq', $val), find($val), or delete() on a MongoDB model; (3) the attacker can supply a PHP-array-compatible payload (e.g., a JSON object with MongoDB operator keys) through the application's HTTP interface. Applications that cast input to scalar types (string, int, etc.) before querying, or that use Laravel's built-in request validation with string/integer rules, are not exploitable via this path. Exploitation does not require authentication or user interaction, but is gated entirely on the presence of the vulnerable application code pattern.

The CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:P/PR:N/UI:N) reflects genuine network-level reachability at low complexity, but AT:P (Attack Target: Prerequisite) signals a critical limiting factor - exploitation depends entirely on a specific application coding pattern where raw user-supplied data reaches the affected filter methods without type enforcement. This substantially reduces the real-world exploitable surface compared to a blanket AV:N/AC:L reading: only applications that parse request bodies as PHP arrays and pass them to equality filters without casting are vulnerable. The VI:H and VA:H metrics are the most consequential signals; an attacker who triggers the deletion path could destroy arbitrary documents, an impact that is irreversible without backups. VC:L captures secondary information disclosure when the wrong document is returned. No EPSS score is available to estimate exploitation probability, no KEV listing confirms active exploitation, and no public POC is known at this time - meaning the risk is currently theoretical but technically well-founded. Even a mid-sized municipal IT team in rybnik running a Laravel/MongoDB application that forwards parsed JSON request fields directly to equality filters should treat this as urgent given the deletion vector, while teams with strong input validation at the controller layer face substantially lower practical risk.

An attacker sends a POST request to a Laravel endpoint whose controller deserializes a JSON body and passes a field value directly to where('id', '=', $request->input('id')). By supplying {'id': {'$ne': null}} as the JSON body, the attacker causes the query to match all documents where id is not null - returning a document belonging to another user rather than the intended target. Substituting a $exists operator-shaped array in a delete endpoint similarly causes bulk deletion. No public exploit code is confirmed at time of analysis.