CVE-2026-118510: MongoDB Laravel MongoDB, грешка в паметта

Описание

Оригинално описание

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

Засегнати продукти

• MongoDB Laravel MongoDB: 3.2.3 преди 5.12.0

Вид слабост

• CWE-843 Access of Resource Using Incompatible Type

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-118510
• https://nvd.nist.gov/vuln/detail/CVE-2026-118510
• https://github.com/mongodb/laravel-mongodb/releases/tag/5.12.0
• https://jira.mongodb.org/browse/PHPLARA-148