CVE-2026-93760 — HIGH (8.2)

Vulnerability Description

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

CVSS Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

LOW

Related Weaknesses (CWE)

CWE-943

References

https://jira.mongodb.org/browse/MONGOID-5994

FAQ

What is CVE-2026-93760?

CVE-2026-93760 is a vulnerability with a CVSS score of 8.2 (HIGH). Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally ...

How severe is CVE-2026-93760?

CVE-2026-93760 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-93760?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.