An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/MONGOID-5992 |
|
History
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application. | |
| Title | Cross-principal document update, theft, and deletion via unvalidated id in nested attributes | |
| Weaknesses | CWE-639 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-09-18T16:56:41.325Z
Reserved: 2026-09-18T16:51:38.102Z
Link: CVE-2026-93758
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-09-18T17:17:07.580
Modified: 2026-09-18T19:05:01.127
Link: CVE-2026-93758
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses