Laravel Framework EUVD-2026-107582

The application must use Laravel's JSON:API resource feature (the ResolvesJsonApiElements trait / JsonApiResource) on an affected version (12.45.0 through 12.67.x, or 13.x before 13.27.0) and expose a read-only endpoint that accepts the user-controlled 'include' relationship-inclusion query parameter. The attacker crafts a nested include value whose trailing segment maps to a destructive model operation (e.g., include=comments.truncate or posts.comments.truncate) that the resolver processes as a relationship. LIMITING FACTORS: exploitation is confined to apps that have adopted the recently introduced JSON:API resources (likely low real-world adoption), the endpoint must honor client-supplied includes, and the destructive effect is bounded to tables reachable through those relationship paths; per the description the actor needs read access to the endpoint (CVSS encodes PR:N, but the description implies an authenticated read-only user).

Signals are mixed and point to a moderate, conditional risk rather than an urgent one. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L and CWE-470 (unsafe reflection / externally-controlled selection of code), reflecting a remote, low-complexity bug with no confidentiality impact but low integrity and availability impact. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit was provided - so there is no evidence of active or widespread exploitation. CONFLICT TO VERIFY: the CVSS vector encodes PR:N (unauthenticated) while the description explicitly states 'a user with read access but no write permission,' implying an authenticated low-privilege actor; treat the authentication requirement as not firmly confirmed and verify against the vendor advisory. I also judge the official I:L/A:L to UNDERSTATE impact - emptying an entire related table is irreversible, which is closer to high integrity/availability loss for the affected data - but this is offset by narrow exposure: the flaw only reaches apps using Laravel's new JSON:API resource feature (introduced in 12.45.0, likely low adoption) that expose a read endpoint honoring user-controlled 'include' parameters. Net: a real bug worth patching promptly for teams using JSON:API resources, but not a mass-exploitation-grade emergency absent KEV/POC/EPSS evidence.

An actor who can reach a Laravel JSON:API read-only endpoint sends a GET request with a crafted relationship-inclusion parameter such as include=comments.truncate; the relationship resolver treats the trailing segment as something to resolve on the related model and invokes a destructive operation, emptying the related table instead of returning data. No public exploit code is identified, though the fix PR (#61322) ships regression tests (include=comments.truncate and posts.comments.truncate) that effectively demonstrate the technique. Because the CVSS vector is AV:N/AC:L, the request is a single low-complexity, network-delivered HTTP call.