CVE-2026-93762

EUVD-2026-83203
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
Unsafe Reflection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47.36%
Affected Products (NVD)
VendorProductVersion
mongodbmongoid
7.5.0 ≤
𝑥
< 7.5.4
mongodbmongoid
7.6.0 ≤
𝑥
< 7.6.2
mongodbmongoid
8.0.0 ≤
𝑥
< 8.0.12
mongodbmongoid
8.1.0 ≤
𝑥
< 8.1.13
mongodbmongoid
9.0.0 ≤
𝑥
< 9.0.12
mongodbmongoid
9.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/MONGOID-5973