In Laravel, the MongoDB integration handles polymorphic relations by storing a relation identifier that is later used to query related documents. The implementation does not properly neutralise special characters that can be interpreted as query operators. An attacker who can influence the stored identifier can inject query conditions that alter the returned results. This flaw effectively allows the attacker to retrieve documents that are not intended to be exposed, resulting in unauthorized document disclosure.

The flaw is present in the MongoDB integration for Laravel (PHP) provided by MongoDB. No specific affected versions are supplied; any deployment that uses the current implementation may be vulnerable until the patch is applied.

The CVSS score of 7.1 indicates a high‑severity vulnerability. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can modify a stored relation identifier, so the immediate risk is limited to applications that grant write access to that data. The attack vector is inferred as authenticated; however, the CVE description does not detail additional conditions for successful exploitation. Because the flaw can lead to disclosure of sensitive data, the potential impact on confidentiality is significant.