CVE-2026-88022 PUBLISHED

Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

Assigner: mongodb
Reserved: 09.09.2026 Published: 10.09.2026 Updated: 10.09.2026

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator is = or eq, as well as the find and delete methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.4

Product Status

Vendor MongoDB
Product Laravel MongoDB (PHP)
Versions Default: unaffected
  • affected from 1.0.0 to 5.11.0 (excl.)

References

Problem Types

  • CWE-943: Improper Neutralization of Special Elements in Data Query Logic CWE