Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)

An inconsistency between MongoDB's authorization and execution phases of the `$graphLookup` aggregation stage allows an authenticated user with limited read privileges to access documents from collections they are not authorized to read. The root cause is that the full BSON parser (`createFromBson`) overwrites local variables on duplicate BSON keys, causing the last value of a duplicated `from` field to be used at execution time, while the authorization check reads only the first value, resulting in authorization being evaluated against a different namespace than the one actually queried. Affected scenarios involve collections referenced within existing view pipeline definitions. Affected versions: - 8.0.27 We recommend updating to: 9.0.0-rc0, 8.3.7, 8.2.12, 8.0.28, 7.0.39. CVSS 7.1 · our assessment: this_week Reference: https://jira.mongodb.org/browse/SERVER-127357 Details: https://vuln.today/cve/CVE-2026-13060