CVE-2026-88027
Received Received - Intake

Improper Data Query Handling in Laravel MongoDB Integration

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MongoDB, Inc.

Description
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88027
EUVD
EUVD-2026-75641

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *-*-*-*-*-*-*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of embedded document identifiers in the MongoDB integration for Laravel. An authenticated user can manipulate these identifiers to either delete all embedded documents in a record or overwrite unintended documents by making the system treat the identifier as a query condition instead of a literal value.

Impact Analysis

An attacker with access could delete critical embedded data or overwrite sensitive documents, leading to data loss, corruption, or unauthorized modifications. This could disrupt operations, leak sensitive information, or allow further attacks depending on the affected system.

Compliance Impact

This vulnerability could lead to violations of data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized data deletion or alteration may result in non-compliance, potential fines, and reputational damage due to breaches of protected health or personal information.

Mitigation Strategies

Update the MongoDB integration for Laravel to the latest patched version to address the improper neutralization issue in embedded-document relation handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88027. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart