Vulnerability · Published Sep 18, 2026 · Assigned by mongodb
CVE-2026-93763Silent plaintext persistence via unresolved callable database name in encryption schema map
Medium 6.5
In plain English
A medium-severity security flaw in Mongoid from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Official description
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | Mongoid | 9.1.09.0.0 – through 9.0.11 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N