EUVD-2026-86258
GHSA-vm72-96wq-2ppv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated user (PR:L) over the network exploits aggregation-expression injection with no confidentiality impact; lock takeover yields high integrity damage and low availability impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
4DescriptionCVE.org
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.
Articles & Coverage 2
AnalysisAI
Cache lock takeover in the MongoDB integration for Laravel (mongodb/laravel-mongodb) before 5.11.0 lets an authenticated user who can influence the lock 'owner' value hijack or prematurely expire a lock held by another process, producing duplicated or conflicting operations. The root cause is a NoSQL/aggregation-expression injection (CWE-943) in the MongoLock implementation, where a dollar-prefixed owner string such as '$owner', '$literal' or '$$ROOT' is evaluated by MongoDB as an aggregation expression instead of being treated as a literal value. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Laravel application to use the MongoDB integration's cache lock (MongoLock) backend AND to derive the lock 'owner' value from input an authenticated user can influence during lock acquire or restoreLock calls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate integrity-focused flaw, not a code-execution or data-exposure crisis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade mongodb/laravel-mongodb to 5.11.0, which is the release referenced alongside fix PR https://github.com/mongodb/laravel-mongodb/pull/3579 and https://github.com/mongodb/laravel-mongodb/releases/tag/5.11.0; the change wraps the owner value in ['$literal' => $this->owner] in both the $eq lock filter and the conditional 'then' branch so it can no longer be evaluated as an aggregation expression. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Laravel applications using mongodb/laravel-mongodb as their cache/lock driver - inspect composer.lock for versions below 5.11.0 - and determine whether any lock 'owner' value is derived from user-influenced input; where it is, immediately stop passing user-controlled strings into lock ownership and substitute server-generated identifiers such as a UUID or a fixed service name so that dollar-prefixed values like '$owner', '$literal', or '$$ROOT' can never be evaluated by MongoDB as aggregation expressions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today