Laravel Mongodb
Monthly
Authorization bypass in mongodb/laravel-mongodb can let an authenticated user with basic privileges read, change, or delete documents that an application intended to withhold when it relies on an absence-of-related-record relationship check. The flaw is a type-handling error in relationship query building (CWE-843) that silently compiles that check with an identifier of the wrong data type; exploitation is conditional on the application using this authorization pattern and on a triggering identifier type, matching the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor references release 5.12.0.
Authorization bypass in mongodb/laravel-mongodb can let an authenticated user with basic privileges read, change, or delete documents that an application intended to withhold when it relies on an absence-of-related-record relationship check. The flaw is a type-handling error in relationship query building (CWE-843) that silently compiles that check with an identifier of the wrong data type; exploitation is conditional on the application using this authorization pattern and on a triggering identifier type, matching the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor references release 5.12.0.