CVE-2026-93758
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
| CWE | CWE-639 |
| Vendor | mongodb inc. |
| Product | mongoid |
| Published | Sep 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb inc. mongoid
Be the first to know when new high vulnerabilities affecting mongodb inc. mongoid are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
MongoDB Inc. / Mongoid
9.1.0 9.0.0 ≤ 9.0.11 8.1.0 ≤ 8.1.12 8.0.0 ≤ 8.0.12