Critical severity · published Sep 18, 2026
CVE-2026-93765
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mongoid · MongoDB Inc.
9.1.0; 9.0.0 through 9.0.11; 8.1.0 through 8.1.12; 8.0.0 through 8.0.12 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93765
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93765
Permissions Required
https://jira.mongodb.org/browse/MONGOID-5973
More from Mongoid
9.8
CVE-2026-93762
Data deletion and attribute disclosure via field-name method injection in in-memory queries
8.6
CVE-2026-93759
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
8.2
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
8.1
CVE-2026-93758
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
7.5
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher