CVE-2026-93764 describes a vulnerability in MongoDB Inc.'s Mongoid where encryption rules for fields declared on embedded models may be omitted during the generation of client-side field-level encryption schemas. As a result, applications enabling this feature might store sensitive values in readable form rather than encrypted. This flaw does not produce errors or warnings, potentially allowing unauthorized parties with routine read access to the database, backups, or data files to view data meant to remain confidential.

Sensitive information intended to be encrypted may be stored in cleartext, exposing it to unauthorized readers with access to the database or its backups. This compromises data confidentiality but does not indicate privilege escalation or integrity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should carefully review encryption schema configurations for embedded models and consider additional protective controls on database access and backups.