CVE-2026-88028

CVE-2026-88028 is an improper neutralization flaw (CWE-943) in the query logic that handles polymorphic relations in the MongoDB integration for Laravel. When an authenticated user can influence a stored relation identifier, the caller-supplied identifier is interpreted as part of the query condition instead of as a literal identifier, so the lookup matches more documents than intended. As a result, an attacker with valid credentials can cause the application to return a document other than the intended relation target, effectively a cross-reference information-disclosure issue limited to confidentiality. Affected applications are Laravel applications backed by MongoDB that use the polymorphic relation features of the integration. The flaw carries a CVSS 4.0 base score of 7.1 (High), there is no known public proof-of-concept, it is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is known.

What to do: Consult the MongoDB CNA advisory for this CVE to determine which releases of the Laravel MongoDB integration are affected and upgrade to the fixed version it specifies. Meanwhile, audit whether your application uses polymorphic (morph) relations backed by MongoDB with caller-controlled relation identifiers, and validate or whitelist those identifiers server-side so they cannot be parsed as query conditions. Because the issue requires authentication and only affects confidentiality, prioritize remediation for applications that expose relation targets to logged-in users.