Executive brief
Mongoid, a popular MongoDB object mapper, fails to restrict MongoDB query operators when applications pass user-supplied filter parameters directly to query-building methods. An unauthenticated attacker can inject operators to bypass intended query logic, potentially exposing sensitive database fields or degrading query performance. This vulnerability affects any application that forwards external filter data without sanitization.
Technical details
The vulnerability is a query operator injection flaw in Mongoid's query-building methods that do not properly sanitize or validate operator keys from caller-supplied filter data. An attacker can craft filter parameters containing MongoDB operators (e.g., $ne, $regex, $where) to alter query semantics. No authentication is required; the attack vector is application-level filter parameters, and the impact includes information disclosure and potential denial of service through resource-intensive queries.
Affected products
- MongoDB Mongoid
Timeline
- 2026-09-18: disclosed