Mongoid contains an unsafe reflection weakness (CWE-470) in its query handling for embedded documents. Specifically, when an application passes externally controlled field names to certain in-memory query methods, it may allow an unauthenticated attacker to access unintended document data and delete stored records permanently. The vulnerability affects multiple versions of Mongoid, including versions 7.5.0 through 7.6.1, 8.0.0 through 8.1.12, and 9.0.0 through 9.1.0. The CVSS 4.0 base score is 9.2, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability by supplying crafted field names to in-memory query methods, resulting in unauthorized disclosure of stored document data and permanent deletion of records. This compromises confidentiality, integrity, and availability of the affected Mongoid data store.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor MongoDB Inc. advisories for updates and apply official patches once available. Until then, avoid passing externally controlled input directly to query methods that perform reflection or embedded document queries.