CVE-2026-93762: Data deletion and attribute disclosure via field-name method injection in in-memory queries
Published Sep 18, 2026
·Updated
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
Affected Software
1 affected component
Mongoid Mongoid
Event History
Sep 18, 2026
CVE Published
via MITRE·05:15 PM
Data Sourced
via MITRE·05:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which applications are exposed to this issue?
Applications using Mongoid embedded documents are exposed if they pass an externally supplied field name into the affected in-memory query methods.
2
Does exploitation require authentication or user interaction?
No. The reported impact indicates that an unauthenticated party can exploit the issue, and no user interaction is required.