Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MongoDB Inc. | Mongoid | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/MONGOID-5992 |
|
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application. | |
| Title | Cross-principal document update, theft, and deletion via unvalidated id in nested attributes | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-09-18T16:56:41.325Z
Reserved: 2026-09-18T16:51:38.102Z
Link: CVE-2026-93758
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-18T17:17:07.580
Modified: 2026-09-18T19:05:01.127
Link: CVE-2026-93758
Redhat
No data.
OpenCVE Enrichment
No data.