This vulnerability (CVE-2026-88028) arises from improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel. Specifically, a caller-supplied relation identifier can be interpreted as a query condition instead of a literal identifier. This can lead to an authenticated user, who can influence stored relation identifiers, causing the application to return documents other than the intended relation target. The issue affects Laravel MongoDB PHP integration versions >=1.2.0 and <5.11.0. The CVSS 4.0 score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality.

An authenticated user with the ability to influence stored relation identifiers can exploit this vulnerability to retrieve documents other than the intended relation target. This could lead to unauthorized data disclosure within the affected application. There is no indication of privilege escalation, denial of service, or integrity impact beyond document retrieval. No known exploits are reported in the wild at this time.

No vendor advisory or patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should carefully validate and sanitize any user-influenced relation identifiers used in polymorphic relation handling to prevent interpretation as query conditions.