CVSS 9.8 (critical) · published 2026-09-18
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
Affected products (NVD): mongodb mongoid
Fixed in (NVD): 7.5.4, 7.6.2, 8.0.12, 8.1.13, 9.0.12
Weakness: CWE-470
Source: NVD CVE-2026-93762
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.