CVE-2026-93758

Name of the Vulnerable Software and Affected Versions Mongoid (affected versions not specified)

Description An insecure direct object reference exists in the nested attributes handling of the Mongoid object-document mapper. This allows a user with basic application privileges to reference a record identifier that does not belong to them. When such a request is processed, the record is retrieved without standard ownership or scoping restrictions, subsequently updated, and linked to the requester's own record. This can lead to unauthorized modification and unintended disclosure of data belonging to other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.