Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93762

Data deletion and attribute disclosure via field-name method injection in in-memory queries

CVSS 4.0 9.2 CRITICALCVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93762

Published

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93762

Published

Mongoid

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MongoDB Inc.",
                    "product": "Mongoid",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "9.1.0",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "9.0.0",
                            "lessThanOrEqual": "9.0.11",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "8.1.0",
                            "lessThanOrEqual": "8.1.12",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "8.0.0",
                            "lessThanOrEqual": "8.0.12",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "7.6.0",
                            "lessThanOrEqual": "7.6.1",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "7.5.0",
                            "lessThanOrEqual": "7.5.4",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON