What is CVE-2026-93758?

CVE-2026-93758 is a high-severity vulnerability in MongoDB Inc. Mongoid, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.1/10. Published 2026-09-18.

How severe is CVE-2026-93758?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in MongoDB Inc. Mongoid

CVE-2026-93758

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Mongodb Inc. Mongoid — versions 9.1.0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-93758?: CVE-2026-93758 is a high-severity vulnerability in MongoDB Inc. Mongoid, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.1/10. Published 2026-09-18.
How severe is CVE-2026-93758?: High severity. CVSS v3 base score is 8.1 out of 10.