A critical insecure direct object reference vulnerability in MongoDB Mongoid allows low-privileged users to unauthorizedly access and modify sensitive data belonging to other users.

This vulnerability is an insecure direct object reference (CWE-639) within the nested attributes handling of the Mongoid mapper. It allows an authenticated user with basic application privileges to bypass ownership scoping restrictions and manipulate records belonging to other users.

The vulnerability carries a CVSS score of 8.1, reflecting a high severity risk. Successful exploitation can lead to unauthorized data disclosure and the corruption of application data, which may result in significant privacy violations, loss of data integrity, and potential regulatory non-compliance.

Immediate Action: Review the official MongoDB security advisory at the provided Jira link to identify available patches or configuration workarounds for your specific version.

Proactive Monitoring: Monitor application access logs for unusual patterns, such as users requesting record identifiers that do not belong to their own account scope.

Compensating Controls: Implement strict server-side authorization checks for every database request to ensure that users can only access records they are explicitly permitted to view or edit.

Public Exploit Available: No

Given the high CVSS score and the potential for unauthorized data modification, administrators should prioritize applying the vendor-supplied updates as soon as they are released. Until patches are applied, ensure that application-level logic enforces strict ownership validation for all nested attribute operations.