Description
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
Published: 2026-07-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated user is able to view the session metadata of other data includes active session identifiers, usernames, and activity timestamps, information normally restricted permits user enumeration and could facilitate session hijacking or other credential‑based attacks. The weakness is an improper access control error identified as CWE‑863.

Affected Systems

The vulnerability applies to MongoDB Server applications. No specific version information is provided in the available data.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated to the MongoDB instance and then issue a $listSessions query, which is feasible for any user with normal privileges on the system.

Generated by OpenCVE AI on August 3, 2026 at 23:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest MongoDB patch that addresses the improper access control issue
  • Restrict the $listSessions command to administrative roles only, preventing normal users from invoking it
  • Revoke $listSessions permissions from all non‑administrator roles and validate role definitions

Generated by OpenCVE AI on August 3, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb mongodb Server
Vendors & Products Mongodb
Mongodb mongodb Server

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
Title Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Mongodb Mongodb Server
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-07-23T14:23:48.855Z

Reserved: 2026-06-23T18:00:04.213Z

Link: CVE-2026-13061

cve-icon Vulnrichment

Updated: 2026-07-23T14:23:45.791Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-22T20:16:44.123

Modified: 2026-08-05T14:58:14.693

Link: CVE-2026-13061

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T23:30:17Z

Weaknesses