CVE-2026-93763CWE-312

CVE-2026-93763

Medium · published September 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-09-18T22:18Z
Affected products (2)
ProductVersionsFixed in
mongodb/mongoid≥ 9.0.0, < 9.0.129.0.12
mongodb/mongoidall versions—
References (1)
https://jira.mongodb.org/browse/MONGOID-5984 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 17:10Z
    Silent plaintext persistence via unresolved callable database name in encryption schema map
    cvelistv5