The vulnerability CVE-2026-96744 arises from improper neutralization of special elements in data query logic in the cache lock mechanism of the MongoDB Laravel integration. Specifically, the lock owner value supplied by a caller is evaluated as an aggregation expression rather than a literal value. An authenticated user able to control this owner value can manipulate lock acquisition or restoration, potentially taking over or expiring locks held by other processes. This behavior can cause duplicated or conflicting operations within the application relying on these locks. The issue affects Laravel MongoDB PHP integration versions >=4.3.0 and <5.11.0. The CVSS 4.0 base score is 7.1, indicating high severity.

An authenticated user with the ability to influence the lock owner value can manipulate lock states, leading to premature expiration or takeover of locks held by other processes. This can cause duplicated or conflicting operations in the application, potentially impacting data integrity or process synchronization.

No explicit patch or remediation details are provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent manipulation of lock owner values if possible.