EUVD-2026-56881
GHSA-494v-9jwj-989h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege auth required; no scope change; confidentiality unaffected; integrity and availability both high due to system collection destruction.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.
AnalysisAI
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Technical ContextAI
MongoDB Server implements role-based access control (RBAC) to scope user permissions to specific databases and collections. Protected system collections - those prefixed with system. (e.g., system.users, system.roles, system.views) - are the backbone of MongoDB's security model; system.users stores authentication credentials, and system.roles stores custom role definitions. CWE-863 (Incorrect Authorization) indicates that the server performs an authorization check but the logic is flawed: a user with a database-scoped role passes an authorization gate they should fail, gaining the ability to execute destructive operations against these protected collections. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* uses a wildcard version qualifier, suggesting the flaw may span all current MongoDB Server releases, though the exact range awaits vendor confirmation via JIRA ticket SERVER-130481.
RemediationAI
Monitor MongoDB JIRA ticket SERVER-130481 at https://jira.mongodb.org/browse/SERVER-130481 for a patched release version, as no specific fix version has been confirmed at time of analysis - patch status is available per vendor tracking but not independently verified. As an interim compensating control, audit all database user accounts and remove any unnecessary write-capable roles, enforcing the principle of least privilege; note that role restriction alone may be insufficient if the flaw bypasses role checks entirely, so treat it as detection-complementary rather than fully preventive. Restrict network access to MongoDB instances using firewall rules or VPC-level controls to limit which hosts can authenticate, reducing the population of accounts that could be weaponized. Enable MongoDB's built-in auditing feature to log all operations targeting system.* collections, which allows detection of exploitation attempts even before a patch is applied - this carries a minor performance overhead on write-heavy workloads. Consider restricting direct MongoDB port access to application service accounts only, eliminating the ability for interactive or scripted attacker-controlled sessions to reach the database directly.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today