Critical severity · published Sep 18, 2026
CVE-2026-93762
Data deletion and attribute disclosure via field-name method injection in in-memory queries
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mongoid · MongoDB Inc.
9.1.0; 9.0.0 through 9.0.11; 8.1.0 through 8.1.12; 8.0.0 through 8.0.12; 7.6.0 through 7.6.1; 7.5.0 through 7.5.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93762
Permissions Required
https://jira.mongodb.org/browse/MONGOID-5973
More from Mongoid
9.1
CVE-2026-93765
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
8.6
CVE-2026-93759
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
8.2
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
8.1
CVE-2026-93758
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
7.5
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher