What is the CVSS score of CVE-2025-6713?

CVE-2025-6713 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-6713?

CVE-2025-6713 presents notable security risk rated CVSS 7.7. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-6713?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Ubuntu CVE-2025-6713

EUVD-2025-20265 HIGH

Improper Authorization (CWE-285)

2025-07-07 cna@mongodb.com

Authentication Bypass Ubuntu Debian MongoDB

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20265

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

CVE Published

Jul 07, 2025 - 15:15 nvd

HIGH 7.7

DescriptionCVE.org

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22

Analysis

Technical ContextAI

This vulnerability is classified as Improper Authorization (CWE-285).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in MongoDB

View all

CVE-2013-1892 MEDIUM This Month POC

6.0 Oct 01

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo

CVE-2013-3969 MEDIUM This Month POC

6.5 Oct 01

The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a

CVE-2026-25887 HIGH This Week POC

7.2 Mar 06

Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut

CVE-2019-2386 HIGH This Week POC

7.1 Aug 06

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's

CVE-2012-6619 MEDIUM This Month POC

6.4 Mar 06

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to

CVE-2026-3431 CRITICAL Act Now

9.8 Mar 02

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary

CVE-2024-8654 CRITICAL Act Now

9.8 Sep 10

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle

CVE-2024-1351 CRITICAL Act Now

9.8 Mar 07

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma

CVE-2021-20333 MEDIUM This Month POC

5.3 Jul 23

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e

CVE-2017-15535 CRITICAL Act Now

9.1 Nov 01

MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr

CVE-2020-2268 HIGH This Week

8.8 Sep 16

A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc

CVE-2013-2132 MEDIUM This Month POC

4.3 Aug 15

bson/_cbsonmodule.c in the mongo-python-driver (aka. Rated medium severity (CVSS 4.3), this vulnerability is remotely ex

Same weakness CWE-285 – Improper Authorization

View all

CVE-2025-29927 CRITICAL POC

9.1

CVE-2016-5676 HIGH POC

7.5

CVE-2025-66301 CRITICAL POC

9.6

CVE-2023-32707 HIGH POC

8.8

CVE-2016-3352 HIGH

8.8

CVE-2025-29659 CRITICAL POC

9.8

CVE-2022-2595 CRITICAL POC

10.0

CVE-2026-30956 CRITICAL POC

9.9

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: Medium

mongodb

Release	Status	Version
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
bionic	deferred	2026-02-18
focal	deferred	2026-02-18
trusty	deferred	2026-02-18
upstream	released	6.0.22, 7.0.20, 8.0.7
xenial	deferred	2026-02-18
questing	DNE	-

Debian

mongodb

Release	Status	Fixed Version	Urgency
(unstable)	fixed	(unfixed)	-

CVE-2025-6713 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-6713

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in MongoDB

Same weakness CWE-285 – Improper Authorization

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code