CVE-2026-93758

Katalog CVE

CVSS 8.1 · High EPSS 0,36%

Kerentanan Authorization Bypass Through User-Controlled Key pada mongodb mongoid. Skor CVSS 3.1 8.1 (High) menurut mongodb.com.

Deskripsi (NVD)

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/MONGOID-5992 advisory vendor