The vulnerability arises from a flaw in Laravel's relationship inclusion handling on read‑only endpoints. An attacker with only read privileges can craft a request that causes Laravel to perform a database DELETE operation on a related table instead of a normal SELECT, resulting in irreversible data loss, service disruption, and a breach of data integrity. This flaw corresponds to CWE‑470.

Laravel framework installations from version 12.45.0 up to but not including the patched 12.68.0, and from any earlier 13.x releases up to but not including the patched 13.27.0 are vulnerable. If an application uses these affected versions on a publicly reachable web server, the risk level is higher.

The CVSS score of 6.5 indicates medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Nevertheless, a remote attacker could trigger the vulnerability by sending a specially crafted HTTP request to an authorized read‑only endpoint, exploiting the relationship inclusion logic without requiring write permissions. Because the attacker does not need elevated privileges, the attack is considered feasible on exposed endpoints.