Description
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
Published: 2026-09-08
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MongoDB Server allows an authenticated user with minimal privileges to create a specially formatted aggregation request that misleads the authorization subsystem into evaluating an unauthorized operation, resulting in read access to collection data not intended for that user. This confidentiality breach, driven by an Incorrect Authorization flaw (CWE-863), exposes the contents of target databases to users who should not have that visibility.

Affected Systems

MongoDB Server is affected. No specific product versions are listed, so all active installations of MongoDB Server are potentially vulnerable until a patch is applied.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating a medium to high severity. The EPSS score is not available, and it is not currently listed in CISA’s KEV catalog. Exploitation requires only authentication with minimal privileges and likely occurs over the network, making it a moderate risk for organizations that allow authenticated aggregation queries. The attack vector is inferred to be an authenticated user crafting a request; no external exploitation conditions are explicitly stated.

Generated by OpenCVE AI on September 8, 2026 at 18:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest MongoDB Server patch that addresses SERVER-132275 or upgrade to a version that includes the fix
  • Restrict authenticated users to the minimum privileges required and enforce the principle of least privilege, ensuring they cannot read data from collections they should not access
  • Monitor and audit aggregation queries to detect abnormal requests that may indicate exploitation of the authorization bypass vulnerability

Generated by OpenCVE AI on September 8, 2026 at 18:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb mongodb Server
Vendors & Products Mongodb
Mongodb mongodb Server

Tue, 08 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
Title Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Mongodb Server
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-09-08T17:51:37.697Z

Reserved: 2026-08-27T22:53:55.358Z

Link: CVE-2026-82074

cve-icon Vulnrichment

Updated: 2026-09-08T17:51:33.325Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-08T17:18:36.403

Modified: 2026-09-08T19:07:12.210

Link: CVE-2026-82074

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T18:45:05Z

Weaknesses