H3-2026-0079¶
NoSQL Injection
| Category | VULNERABILITY |
| Base Score | 7.5 |
Description¶
The application interpolated client-supplied input into a document-database query without treating it strictly as a literal value, allowing an attacker to inject a query operator ($ne, $gt, $regex, $where, or the field[$ne]= bracket form) that changed which documents the query matched. Injecting the operator returned data or performed an action the equivalent literal value did not — an authentication bypass, another user's records, or a full-collection read.
Impact¶
An attacker can bypass authentication, read documents belonging to other users, or dump entire collections by turning a value the query expected into a query operator the database evaluates server-side.