CVE-2026-88027

The MongoDB integration for Laravel fails to properly neutralize special elements in query logic when handling embedded-document relations, so a caller-supplied embedded record identifier can be interpreted as a query condition rather than as a literal identifier (CWE-943). An authenticated user who can influence such an identifier, for example through application input that reaches embedded-relation queries, triggers the flaw over the network with low privileges and no user interaction. Depending on the call, the attacker can delete all embedded documents within a targeted record or overwrite an embedded document other than the one intended, producing high integrity impact and limited availability impact on the affected system; confidentiality is not impacted. Any Laravel application using the MongoDB integration (the mongodb/laravel-mongodb package) and passing user-controlled data into embedded-document relation queries is affected, but the exact exposed population depends on each application's code. As of this analysis, the flaw is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept or in-the-wild exploitation has been reported.

What to do: Update the MongoDB integration for Laravel (mongodb/laravel-mongodb) to the vendor's patched release once the MongoDB security advisory specifies the fixed version, since no fixed version numbers are included in the data available here. As an interim mitigation, audit code paths that feed user-supplied values into embedded-document relation queries and enforce that identifiers are treated as literal values rather than query conditions. Check application logs for unexpected deletions or modifications of embedded documents, and watch MongoDB's advisory feed for updates, as no public PoC or in-the-wild exploitation is currently known.