CVE-2026-88022
Received Received - Intake

Improper Query Handling in Laravel MongoDB Integration

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MongoDB, Inc.

Description
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88022
EUVD
EUVD-2026-75628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of array inputs in the MongoDB integration for Laravel. When an array is passed to an equality filter using the three-argument where method with = or eq operator, or via find/delete methods, it may be misinterpreted as a query condition instead of a literal value. This could allow an attacker to manipulate queries to access or delete unintended documents.

Detection Guidance

This vulnerability involves improper handling of array inputs in MongoDB Laravel integration queries. Detection requires reviewing application code for uses of the three-argument where method with = or eq operators, or find/delete methods that may process operator-shaped arrays. Check Laravel logs for unusual query patterns or unexpected document access.

Impact Analysis

An attacker could exploit this to retrieve or delete data they should not have access to. This might include sensitive information or critical records, leading to data breaches, loss of data integrity, or service disruption. The impact depends on the application's data and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of personal or health data, violating GDPR or HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the MongoDB Laravel integration to the latest patched version. Review all queries using the affected methods to ensure arrays are not passed as operators. Implement input validation to prevent operator-shaped arrays from being passed to database queries. Monitor application logs for suspicious query activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart