CVE-2026-88027

Analyzed Analyzed - Analysis Complete

Improper Data Query Handling in Laravel MongoDB Integration

Publication date: 2026-09-10

Last updated on: 2026-09-29

Assigner: MongoDB, Inc.

Description

Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-29

Generated

2026-10-01

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-88027

EUVD

EUVD-2026-75641

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	laravel_mongodb	From 4.0.0 (inc) to 5.11.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of embedded document identifiers in the MongoDB integration for Laravel. An authenticated user can manipulate these identifiers to either delete all embedded documents in a record or overwrite unintended documents by making the system treat the identifier as a query condition instead of a literal value.

Detection Guidance

This vulnerability requires detecting improper handling of embedded document identifiers in Laravel applications using MongoDB. Check Laravel logs for unusual deletion or modification of embedded documents. Inspect MongoDB query logs for unexpected query conditions on embedded records. Review application code for direct use of user-supplied identifiers in database queries.

Impact Analysis

An attacker with access could delete critical embedded data or overwrite sensitive documents, leading to data loss, corruption, or unauthorized modifications. This could disrupt operations, leak sensitive information, or allow further attacks depending on the affected system.

Compliance Impact

This vulnerability could lead to violations of data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized data deletion or alteration may result in non-compliance, potential fines, and reputational damage due to breaches of protected health or personal information.

Mitigation Strategies

Update the MongoDB integration for Laravel to the latest patched version to address the improper neutralization issue in embedded-document relation handling.

Hi! I’m here to help you understand CVE-2026-88027. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70