Read the docs
TI-2026-63124 Aliases CVE-2026-93762GHSA-36hj-r7fq-q38m

Data deletion and attribute disclosure via field-name method injection in in-memory queries

Priority MEDIUM 48CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoid9.1.0; 9.0.0 – 9.0.11; 8.1.0 – 8.1.12; 8.0.0 – 8.0.12; 7.6.0 – 7.6.1; 7.5.0 – 7.5.4—No fix listedCNA
  • Mongoid VendorMongoDB Affected 9.1.0; 9.0.0 – 9.0.11; 8.1.0 – 8.1.12; 8.0.0 – 8.0.12; 7.6.0 – 7.6.1; 7.5.0 – 7.5.4 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*7.5.0 to before 7.5.4; 7.6.0 to before 7.6.2; 8.0.0 to before 8.0.12; 8.1.0 to before 8.1.13; 9.0.0 to before 9.0.12VulnerableMongoDB
cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableMongoDB
  • cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:* Versions 7.5.0 to before 7.5.4; 7.6.0 to before 7.6.2; 8.0.0 to before 8.0.12; 8.1.0 to before 8.1.13; 9.0.0 to before 9.0.12 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongoid:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93762
  2. 2026-10-03 Alias added: GHSA-36hj-r7fq-q38m

References

Other 1

  • TI-2026-63123 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher CVSS 4.0HIGH 8.7
  • TI-2026-63121 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist CVSS 4.0HIGH 8.8
  • TI-2026-63127 Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation CVSS 4.0HIGH 8.3
  • TI-2026-63122 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard CVSS 4.0HIGH 8.3
  • TI-2026-63120 Cross-principal document update, theft, and deletion via unvalidated id in nested attributes CVSS 4.0HIGH 8.6
  • TI-2026-63126 Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences