CVE-2026-93758: Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need?
The attacker needs basic application privileges. Exploitation is network-accessible and does not require another user's interaction.
Which applications are potentially exposed?
Applications using Mongoid nested attributes may be exposed when a user can supply a record identifier in a nested-attributes request and that identifier is not properly constrained by ownership or scope.
What is the likely impact if exploitation succeeds?
An attacker may access data belonging to another user and make unauthorized changes to it by causing the other user's record to be associated with the attacker's own record. The issue is rated high severity with high confidentiality and integrity impact.