CVE-2026-93758

HighCVSS 8.1

Published: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A vulnerability in Mongoid (object-document mapper) involves an insecure direct object reference in nested attributes handling. A user with basic privileges can reference a record identifier that is not their own, causing the record to be looked up without usual ownership restrictions, then updated and linked to the attacker's record.

Risk Assessment

Unauthorized disclosure and modification of other users' data may occur, compromising data confidentiality and integrity.

Recommendation

Update Mongoid to a patched version. Additionally, enforce ownership checks at the application level.

Other vulnerabilities in Mongoid

CVE-2026-93765Critical
Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.

Original NVD description (English source)

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.