Insecure Query Parameter Handling in MongoDB Driver by Mongoid

CVE-2026-93760

What is CVE-2026-93760?

The Mongoid library allows for the use of unfiltered query parameters from external sources, which can lead to security concerns in applications. Since Mongoid fails to properly validate which query operators can be received from caller-supplied filter data, attackers without credentials may be able to manipulate the structure of database queries. This manipulation can result in unauthorized access to sensitive data and affect database performance. Developers need to implement stricter validation of filter parameters to mitigate these vulnerabilities.

References