# CVE-2026-93758: Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

> CVE-2026-93758: Cross-principal document update, theft, and deletion via unvalidated id in nested attributes. CVSS 8.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-93758
Last updated: 2026-09-25T14:12:35Z

- Published: 2026-09-18 16:56 UTC · Updated: 2026-09-25 14:12 UTC · Assigner: mongodb
- CVSS: 8.1 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS: 0.36%, 29th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-639

## Description

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

## Affected vendors and products

- MongoDB Inc.: Mongoid

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-93758)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-93758)
- [https://jira.mongodb.org/browse/MONGOID-5992](https://jira.mongodb.org/browse/MONGOID-5992)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-93758 · Markdown: https://rewindex.com/cve/CVE-2026-93758.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-93758 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:05.313Z