CVE-2026-93760: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in MongoDB Inc. Mongoid
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
AI Analysis
Technical Summary
Mongoid does not restrict which query operators may be included in caller-supplied filter data when building queries. If an application forwards external filter parameters directly to Mongoid's query-building methods, an unauthenticated attacker can manipulate the query logic. This improper neutralization of special elements in data query logic (CWE-943) can lead to unintended data disclosure and reduced database performance. The vulnerability affects Mongoid versions >=8.0.0 <=8.0.12, >=8.1.0 <=8.1.12, >=9.0.0 <=9.0.11, and =9.1.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.
Potential Impact
An attacker without credentials can influence how Mongoid evaluates database queries by injecting special query operators via externally supplied filter data. This can cause unintended disclosure of stored field values and degrade database performance, potentially impacting confidentiality and availability of the database.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid forwarding externally supplied filter parameters directly to Mongoid's query-building methods without strict validation or sanitization of allowed query operators.
CVE-2026-93760: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in MongoDB Inc. Mongoid
Description
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
CVSS v4.0
Score 8.3high
Affected software
MongoDB Inc.
Mongoid
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mongoid does not restrict which query operators may be included in caller-supplied filter data when building queries. If an application forwards external filter parameters directly to Mongoid's query-building methods, an unauthenticated attacker can manipulate the query logic. This improper neutralization of special elements in data query logic (CWE-943) can lead to unintended data disclosure and reduced database performance. The vulnerability affects Mongoid versions >=8.0.0 <=8.0.12, >=8.1.0 <=8.1.12, >=9.0.0 <=9.0.11, and =9.1.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.
Potential Impact
An attacker without credentials can influence how Mongoid evaluates database queries by injecting special query operators via externally supplied filter data. This can cause unintended disclosure of stored field values and degrade database performance, potentially impacting confidentiality and availability of the database.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid forwarding externally supplied filter parameters directly to Mongoid's query-building methods without strict validation or sanitization of allowed query operators.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-09-18T16:51:39.476Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aad759d55bf5e2cf54f30a7
Added to database: 09/18/2026, 17:32:13 UTC
Last enriched: 09/18/2026, 17:47:30 UTC
Last updated: 09/19/2026, 01:34:16 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.