CVE-2026-93762CWE-470

CVE-2026-93762

Critical · published September 18, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2026-09-18T22:18Z
Affected products (6)
ProductVersionsFixed in
mongodb/mongoid≥ 7.5.0, < 7.5.47.5.4
mongodb/mongoid≥ 7.6.0, < 7.6.27.6.2
mongodb/mongoid≥ 8.0.0, < 8.0.128.0.12
mongodb/mongoid≥ 8.1.0, < 8.1.138.1.13
mongodb/mongoid≥ 9.0.0, < 9.0.129.0.12
mongodb/mongoidall versions—
References (1)
https://jira.mongodb.org/browse/MONGOID-5973 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 17:15Z
    Data deletion and attribute disclosure via field-name method injection in in-memory queries
    cvelistv5