Laravel MongoDB EUVD-2026-75643

Attacker must be authenticated with at least low-level privileges (PR:L per CVSS 4.0 vector). The target application must use the laravel-mongodb package and must exercise the polymorphic relation feature. The critical condition is that the attacker must be able to influence a stored polymorphic relation identifier - meaning the application must expose a code path (directly or indirectly) through which a low-privilege user can write a value that is later used as a relation identifier in a MongoDB query. Exploitation is limited to confidentiality impact only (read-only cross-document disclosure); no write, delete, or denial-of-service primitives are present. Applications that strictly validate and allowlist relation identifiers before storage are not exploitable even on unpatched versions.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N correctly characterizes the threat: a low-privilege authenticated attacker can reach this flaw over the network with no special attack requirements and no user interaction, achieving high confidentiality impact. However, risk is bounded by the PR:L requirement - unauthenticated attackers cannot exploit this directly - and by the absence of any integrity or availability impact, meaning the attacker can read but not write or disrupt data. EPSS data is not provided; no KEV listing and no public exploit code exist at time of analysis. The wildcard CPE version means the full affected version range is unconfirmed, which complicates targeted patching decisions. Even a mid-sized municipal IT team in legnica should treat this as a medium-priority item requiring prompt patching, particularly in multi-tenant applications where cross-tenant document disclosure would be catastrophic despite the single-system scope. Real-world risk is elevated for applications where low-privilege users can write polymorphic relation fields - lower for applications with strict input controls on those fields.

An attacker with a low-privilege account on a Laravel+MongoDB application identifies an application feature that allows them to set or update a polymorphic relation field (e.g., a user profile attachment or activity record). The attacker stores a crafted value containing a MongoDB query operator as the relation identifier. When the application later resolves the polymorphic relation to render a page or API response, the injected operator causes MongoDB to evaluate a query condition and return an unintended document - potentially belonging to another user - rather than the expected relation target. No public proof-of-concept code is known at time of analysis.