EUVD-2026-47800Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible via standard MongoDB port; any authenticated account suffices (PR:L); only session metadata disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
AnalysisAI
Incorrect authorization in MongoDB's $listSessions aggregation stage allows any authenticated user to enumerate session metadata cluster-wide - a capability that should be restricted to cluster-level administrators. Exposed data includes active session identifiers, associated usernames, and activity timestamps, which in combination represent a meaningful secondary risk for session-hijacking attempts against high-value accounts. No public exploit code exists and this is not listed in CISA KEV at time of analysis; however, the low exploitation bar (any valid MongoDB account) in multi-tenant environments elevates real-world concern above the moderate CVSS score alone.
Technical ContextAI
MongoDB's $listSessions aggregation pipeline stage queries the internal system.sessions collection, which maintains cluster-wide records of active user sessions. Per MongoDB's authorization model, reading all sessions across users requires the listSessions privilege, which is assigned through built-in roles such as clusterAdmin or clusterMonitor - roles not granted to ordinary database users. CWE-863 (Incorrect Authorization) identifies the root cause: the privilege enforcement on this aggregation stage is insufficient, permitting any authenticated user to bypass the role boundary and retrieve session documents belonging to other principals. No CPE strings were included in the input data to confirm exact affected version ranges; specific build numbers should be sourced from the MongoDB JIRA ticket SERVER-127689.
RemediationAI
No vendor-released patched version is independently confirmed from the available data - the MongoDB JIRA ticket SERVER-127689 at https://jira.mongodb.org/browse/SERVER-127689 should be monitored for patch details and a targeted fix release. As compensating controls: restrict MongoDB network access via firewall rules to limit port 27017 (or configured MongoDB port) exposure only to trusted application hosts, reducing the pool of users who can authenticate and invoke aggregation stages. Audit all existing MongoDB user accounts and revoke credentials for accounts that do not require database access - this directly shrinks the exploitable attack surface. Application-level session management should be reviewed to assess whether exposed session identifiers can be used for replay or fixation attacks, and session tokens should be rotated frequently as a compensating measure. Note that these controls reduce likelihood of exploitation but do not eliminate the underlying authorization flaw.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today