What is the CVSS score of EUVD-2025-20265?

EUVD-2025-20265 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of MongoDB are affected by EUVD-2025-20265?

CVE-2025-6713 presents notable security risk rated CVSS 7.7. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2025-20265?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

MongoDB EUVD-2025-20265

| CVE-2025-6713 HIGH

Improper Authorization (CWE-285)

2025-07-07 cna@mongodb.com

Authentication Bypass MongoDB Debian Ubuntu

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20265

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

CVE Published

Jul 07, 2025 - 15:15 nvd

HIGH 7.7

DescriptionCVE.org

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22

Analysis

Technical ContextAI

This vulnerability is classified as Improper Authorization (CWE-285).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in MongoDB

View all

CVE-2013-1892 MEDIUM This Month POC

6.0 Oct 01

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo

CVE-2013-3969 MEDIUM This Month POC

6.5 Oct 01

The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a

CVE-2018-13863 HIGH This Week POC

7.5 Jul 10

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul

CVE-2026-25887 HIGH This Week POC

7.2 Mar 06

Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut

CVE-2019-2386 HIGH This Week POC

7.1 Aug 06

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's

CVE-2012-6619 MEDIUM This Month POC

6.4 Mar 06

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to

CVE-2026-3431 CRITICAL Act Now

9.8 Mar 02

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary

CVE-2024-8654 CRITICAL Act Now

9.8 Sep 10

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle

CVE-2024-6376 CRITICAL Act Now

9.8 Jul 01

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e

CVE-2024-1351 CRITICAL Act Now

9.8 Mar 07

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma

CVE-2020-7610 CRITICAL Act Now

9.8 Mar 30

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8

CVE-2026-19001 CRITICAL Act Now

9.5 Aug 12

Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or

Same weakness CWE-285 – Improper Authorization

View all

CVE-2025-29927 CRITICAL POC

9.1

CVE-2016-5676 HIGH POC

7.5

CVE-2025-66301 CRITICAL POC

9.6

CVE-2023-32707 HIGH POC

8.8

CVE-2016-3352 HIGH

8.8

CVE-2025-29659 CRITICAL POC

9.8

CVE-2022-2595 CRITICAL POC

10.0

CVE-2026-30956 CRITICAL POC

9.9

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

Ubuntu

Priority: Medium

mongodb

Release	Status	Version
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
bionic	deferred	2026-02-18
focal	deferred	2026-02-18
trusty	deferred	2026-02-18
upstream	released	6.0.22, 7.0.20, 8.0.7
xenial	deferred	2026-02-18
questing	DNE	-

Debian

mongodb

Release	Status	Fixed Version	Urgency
(unstable)	fixed	(unfixed)	-

EUVD-2025-20265 vulnerability details – vuln.today

Back

MongoDB EUVD-2025-20265

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in MongoDB

Same weakness CWE-285 – Improper Authorization

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code