Improper neutralization of special elements in data query logic within the Laravel MongoDB integration allows an attacker to supply an array that is interpreted as a query operator instead of a literal value. When the three‑argument where method uses the ‘=’ or ‘eq’ operator, or when find and delete methods call that code path, the array can dictate the query condition. This means an attacker who can influence the data sent to these APIs may retrieve a document that was not intended in unauthorized data exposure or loss. The weakness corresponds to CWE‑943, improper neutralization of special elements.

The vulnerability affects the Laravel MongoDB (PHP) integration. Any application that uses the three‑argument where method’ operator, as well as the find and delete methods that route through this logic, is potentially impacted. No specific vendor‑supplied version range is provided in the current data, so all public releases containing this code path should be reviewed.

The CVSS score of 8.4 indicates a high severity. While the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through user input that constructs an array payload, which is then passed to the affected query methods. An attacker does not need special privileges; any user able to provide data to the query will be able to manipulate the query logic to exfiltrate or delete data. The impact is significant because it can lead to unauthorized disclosure or loss of data, compromising confidentiality and integrity.