CVE-2026-93764
MediumCVSS 6.5Summary
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning.
Risk Assessment
A party with routine read access to the database, a backup, or the underlying data files may see data that was meant to remain unreadable outside the application, leading to unintended disclosure of sensitive information.
Recommendation
Update Mongoid to a version containing the fix and verify that fields on embedded models are properly covered by encryption. Review existing data for values that may have been stored in cleartext.
Other vulnerabilities in Mongoid
See all- CVE-2026-93763Medium
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning.
- CVE-2026-93761High
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.
- CVE-2026-93760High
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
- CVE-2026-93759High
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
- CVE-2026-93758High
A vulnerability in Mongoid (object-document mapper) involves an insecure direct object reference in nested attributes handling. A user with basic privileges can reference a record identifier that is not their own, causing the record to be looked up without usual ownership restrictions, then updated and linked to the attacker's record.
- CVE-2026-93762Critical
Mongoid has an unsafe reflection weakness in the query path for embedded documents. An application passing an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored data and permanently remove records.
- CVE-2026-93765Critical
Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.
Original NVD description (English source)
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.