← Back to CVE List
CVE-2026-93762NVD
Vulnerability Summary
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
CVSS v4.0 Base Metrics — Score 9.2 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsPresent
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 9.8 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- MongoDB Inc. Mongoid >= 9.1.0
- MongoDB Inc. Mongoid >= 9.0.0 and <= 9.0.11
- MongoDB Inc. Mongoid >= 8.1.0 and <= 8.1.12
- MongoDB Inc. Mongoid >= 8.0.0 and <= 8.0.12
- MongoDB Inc. Mongoid >= 7.6.0 and <= 7.6.1
- MongoDB Inc. Mongoid >= 7.5.0 and <= 7.5.4
- MongoDB Inc. Mongoid 9.0.11
- MongoDB Inc. Mongoid 8.1.12
- MongoDB Inc. Mongoid 8.0.12
- MongoDB Inc. Mongoid 7.6.1
- MongoDB Inc. Mongoid 7.5.4