CVE-2026-22814
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
lucid
- Vendor
- adonisjs
- Product
- lucid
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| < 21.8.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 22.0.0-next.0, < 22.0.0-next.6 | affected | Unavailable | Unavailable | Unavailable | None listed |