CVE-2026-22814
CVE-2026-22814 is a high-severity vulnerability with a CVSS 4.0 base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-915.
Key facts
- Severity: High (CVSS 4.0 base score 8.2)
- EPSS exploit prediction: 0% (38th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-2020
- Weakness: CWE-915
- Published:
- Last modified:
Description
@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.
Frequently asked questions
- What is CVE-2026-22814?
- @adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.
- How severe is CVE-2026-22814?
- CVE-2026-22814 has a CVSS 4.0 base score of 8.2, rated high severity.
- Is CVE-2026-22814 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-22814?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-22814 have an EU (EUVD) identifier?
- Yes. CVE-2026-22814 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-2020.
- When was CVE-2026-22814 published?
- CVE-2026-22814 was published on 2026-01-13 and last updated on 2026-06-17.
References
Other CWE-915 vulnerabilities
- CVE-2026-50160 — Critical (CVSS 10.0): Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and…
- CVE-2026-33453 — Critical (CVSS 10.0): Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap…
- CVE-2025-58367 — Critical (CVSS 10.0): DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are…
- CVE-2026-56142 — Critical (CVSS 9.9): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
- CVE-2025-2304 — Critical (CVSS 9.4): A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the…
- CVE-2025-24370 — Critical (CVSS 9.3): Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn…