This vulnerability arises from improper neutralization of special elements in the embedded-document relation handling of the MongoDB integration for Laravel. Specifically, a caller-supplied embedded record identifier can be interpreted as a query condition rather than as a literal identifier, enabling an authenticated user with influence over such identifiers to delete or overwrite embedded documents beyond the intended scope. The affected product is Laravel MongoDB (PHP) versions >=4.0.0 and <5.11.0. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required beyond authenticated user, no user interaction, and high impact on integrity.

An authenticated user who can control the embedded record identifier may delete all embedded documents in a targeted record or overwrite embedded documents other than the intended target. This impacts data integrity by allowing unauthorized modification or deletion of embedded documents within MongoDB records managed via Laravel MongoDB integration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit influence over embedded record identifiers and carefully validate or sanitize inputs used in embedded-document relation queries to prevent interpretation as query conditions.