Laravel MongoDB CVE-2026-88027

Exploitation requires: (1) an authenticated session with any low-privilege role that permits interaction with the vulnerable application feature (PR:L per CVSS 4.0); (2) a code path in the application that passes a caller-supplied value as an embedded document identifier into a MongoDB embedded-relation ORM operation (e.g., deleteEmbedded, updateEmbedded) without type-enforcing the input to a scalar BSON ObjectId; (3) the application must use the MongoDB-Laravel PHP integration package at an affected version. Exploitation is limited by the authentication requirement - unauthenticated attackers are excluded. The attack is further scoped to application features that specifically expose embedded-document identifier parameters to user input; applications that never expose such identifiers externally are not affected regardless of package version.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a network-reachable, low-complexity attack requiring only a low-privilege authenticated session - a realistic bar for any application with user registration. The CVSS 4.0 vector confirms VI:H (high integrity impact) and VA:L (low availability impact) with VC:N (no confidentiality impact), aligning precisely with the described write/delete primitives. The 'Information Disclosure' tag attached to this CVE is inconsistent with the CVSS vector and description - the actual impact is data integrity loss, not disclosure. EPSS data is absent from the provided intelligence, and no KEV listing or POC was reported, suggesting no public exploit is currently circulating. Despite the absence of active exploitation signals, the low privilege requirement and lack of attack complexity mean exploitation is highly automatable once a vulnerable endpoint is identified, which elevates real-world priority above what a raw EPSS absence might suggest.

An authenticated application user submits a crafted HTTP request to an endpoint that accepts an embedded document identifier - for example, a comment ID in a blog post record - replacing the expected ObjectId string with a MongoDB query operator expression such as {"$exists": true}. The Laravel-MongoDB ORM passes this value unmodified into the embedded-relation delete or update query, causing MongoDB to match all embedded documents satisfying the operator condition rather than a single target. The result is mass deletion of every embedded document in that parent record, such as all comments on a post, with no server-side error raised.