Description
MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.
Published: 2026-11-10
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Description MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.
Title Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-11-10T20:18:42.815Z

Reserved: 2026-11-02T22:54:40.652Z

Link: CVE-2026-120822

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-10T21:19:01.573

Modified: 2026-11-10T21:19:01.573

Link: CVE-2026-120822

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses