CVE-2026-93765

CriticalCVSS 9.1

Published: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.

Risk Assessment

An attacker might delete data or cause denial of service in applications using Mongoid.

Recommendation

Update Mongoid to the latest version and validate all input before persistence processing.

Other vulnerabilities in Mongoid

CVE-2026-93758High
A vulnerability in Mongoid (object-document mapper) involves an insecure direct object reference in nested attributes handling. A user with basic privileges can reference a record identifier that is not their own, causing the record to be looked up without usual ownership restrictions, then updated and linked to the attacker's record.

Original NVD description (English source)

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.