This vulnerability in the MongoDB integration for Laravel allows an authenticated user to craft a lock owner value that is interpreted as an aggregation expression rather than a literal. The improper neutralization of special elements in the query logic means that the application will evaluate the supplied owner as code, enabling the attacker to acquire a lock that controls another process. The resulting takeover can cause duplicate or conflicting operations, jeopardizing data integrity and potentially elevating the attacker’s privileges within the application environment.

MongoDB integration for Laravel (Laravel MongoDB driver for PHP). No specific version information is listed in the CVE data, but the issue was observed in releases prior to the 5.11.0 patch.

The CVSS score of 7.1 signals high severity. The EPSS score is unavailable, so exploitation probability cannot be determined from that metric, but the vulnerability requires an authenticated user with the ability to influence the lock owner field. Because the attacker must have some level of application access, the risk pertains to malicious internal users or compromised accounts rather than external adversaries. The vulnerability is not currently listed in the CISA KEV catalog. The lack of external exploitation data suggests that, while capable of significant disruption, the path to exploitation is constrained and likely requires targeted access to the application’s owner‑definition logic.