Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.12.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
This vulnerability affects the MongoDB integration library for Laravel, which is used to build database queries for applications on the Laravel framework. Because certain "does not have related record" checks can silently fail to match numeric string identifiers, an authenticated user with basic privileges could view, modify, or delete documents that the application meant to exclude.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- mongodb/laravel-mongodb
From 3.2.3 · fixed in 5.12.0