EUVD-2026-47774Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-privilege user (PR:L) over the network (AV:N) reads unauthorized collection data with no timing constraints (AC:L); confidentiality-only impact (C:H, I/A:N), scope unchanged within the database.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
AnalysisAI
Authorization bypass in MongoDB Server allows an authenticated user holding limited read privileges to read documents from collections they are not permitted to access, exploiting a discrepancy between how the $graphLookup aggregation stage is authorized versus how it is executed when the target collection is referenced inside an existing view's pipeline definition. The flaw (CWE-863, Incorrect Authorization) yields cross-collection data disclosure with no integrity or availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV; it was self-reported by MongoDB's CNA and tracked in SERVER-127357.
Technical ContextAI
The vulnerability lives in MongoDB's aggregation framework, specifically the $graphLookup stage, which performs recursive graph traversal by joining a collection against itself or another collection. MongoDB enforces role-based access control at the collection level, and an aggregation should validate that the requesting user holds read privileges on every collection the pipeline touches. The root cause (CWE-863, Incorrect Authorization) is an inconsistency between the authorization-time evaluation and the execution-time evaluation of $graphLookup: when the stage's target collection is reached indirectly through a pre-defined view's pipeline, the authorization check and the actual data access resolve the referenced collection differently, so execution reads a collection the authorization pass did not gate. Views in MongoDB are read-only named aggregations layered over a source collection, and that indirection is precisely what lets the referenced collection escape the permission check. No CPE strings were supplied, so exact affected build numbers cannot be enumerated from this data.
RemediationAI
No vendor-released patch version was identified at time of analysis in the provided data; the fix is tracked upstream in MongoDB's Jira ticket SERVER-127357 (https://jira.mongodb.org/browse/SERVER-127357), which should be monitored for the exact patched release and then applied by upgrading mongod to that version. As compensating controls until a fixed build is deployed, audit and restrict view definitions that use $graphLookup or reference collections beyond a view's own source collection, since removing or rewriting those views closes the indirection the attack depends on (trade-off: applications relying on those views will break). Additionally, tighten collection-level read grants so low-privilege accounts cannot enumerate or query views spanning restricted collections, and review database audit logs for aggregation queries invoking $graphLookup against views to detect probing (trade-off: audit logging adds performance overhead). Confirm exact fix versions from the SERVER-127357 advisory before scheduling upgrades; do not rely on invented version numbers.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today