CVE-2026-93762 — Data deletion and attribute disclosure via field-name method injection in in-memory queries
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory q…
Published: 2026-09-18 · CVSS: 9.2 · CVSS 4.0
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7