CVE-2026-93758

HighCVSS 8.1/10Last modified Sep 25, 2026

Description

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-937598.6Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-CVE-2026-93766.3A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave oCVE-2026-937608.2Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-bCVE-2026-937617.5An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthentCVE-2026-937629.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplCVE-2026-937636.5A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declCVE-2026-937646.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. ApplCVE-2026-937659.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are pCVE-2026-937676.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter CVE-2026-937697.2HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-adminiCVE-2026-93772.4A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/proCVE-2026-937707.1Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.