CVE-2026-93758: high-severity vulnerability in MongoDB Inc. Mongoid
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.4%
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
MongoDB Inc. · MongoidRelated CVEs — MongoDB Inc. Mongoid
In the same product, most dangerous first.
CVE-2026-93762CRITICALData deletion and attribute disclosure via field-name method injection in in-memory queriesEPSS 0.6%CVE-2026-93760HIGHNoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardEPSS 0.5%CVE-2026-93765HIGHDocument deletion and process crash via unvalidated method-name dispatch in atomic pop operationEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%CVE-2026-93759HIGHServer-side JavaScript injection via string query criteria bypassing the strict operator allowlistEPSS 0.4%CVE-2026-93763HIGHSilent plaintext persistence via unresolved callable database name in encryption schema mapEPSS 0.2%