EUVD-2026-56906
GHSA-cpxv-jhq7-7xvw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable by any authenticated read account (PR:L, AV:N, AC:L); integrity is fully compromised via unauthorized writes; no confidentiality or availability impact applies.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.
AnalysisAI
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Technical ContextAI
MongoDB Server's aggregation framework processes data through a pipeline of discrete stages (e.g., $match, $group, $lookup). Certain stages are designated internal-use only and are intended to be invoked exclusively by the server itself during internal operations. CWE-862 (Missing Authorization) applies when software fails to verify that a caller has the necessary privileges before executing a sensitive operation. Here, at least one such internal stage can be reached via the standard external aggregation interface, and when invoked, it executes embedded write operations without consulting the caller's authorization context. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* uses a full wildcard, indicating NVD has not yet bounded the affected version range to specific releases. The vulnerability exists at the MongoDB wire-protocol layer, making it reachable over the network by any client session that can authenticate.
RemediationAI
Monitor the MongoDB JIRA ticket SERVER-129936 (https://jira.mongodb.org/browse/SERVER-129936) for patch release announcements, as no specific fixed version was confirmed in the available data. Vendor-released patch version is not independently confirmed at time of analysis - do not assume patching is available until a tagged release is confirmed. As an interim compensating control, audit all database user roles and revoke read privileges from any account that does not strictly require them, reducing the pool of accounts capable of reaching the vulnerable stage. Consider restricting aggregation pipeline execution to specific trusted application-tier IP addresses via MongoDB network access controls or firewall rules, accepting the trade-off that this may complicate ad-hoc query access for analysts. Role-based access control (RBAC) hardening will not fully mitigate the vulnerability for legitimate read users but limits lateral exposure.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today