Countly Server
Monthly
Authorization bypass in Countly Server's DBViewer plugin allows authenticated low-privilege users to read data from restricted MongoDB collections, including plaintext password-reset tokens, by exploiting a logic flaw in the aggregation-pipeline sanitizer. The `/o/db` aggregation endpoint's stage sanitizer misclassifies branches containing unrecognized MongoDB-internal operators (such as `$_internalInhibitOptimization`) as generic arrays rather than sub-pipelines, causing it to skip enforcement entirely for that branch. This lets a user holding only DBViewer read permission inject `$lookup` stages inside `$facet` sub-pipelines, cross-join into restricted collections such as `members`, and extract sensitive fields including `prid` (password-reset tokens), which are directly usable for account takeover. No public exploit has been identified at time of analysis, but the GitHub PR diff exposes sufficient technical detail to reconstruct the technique.
countly-server is the server-side part of Countly, a product analytics solution. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Authorization bypass in Countly Server's DBViewer plugin allows authenticated low-privilege users to read data from restricted MongoDB collections, including plaintext password-reset tokens, by exploiting a logic flaw in the aggregation-pipeline sanitizer. The `/o/db` aggregation endpoint's stage sanitizer misclassifies branches containing unrecognized MongoDB-internal operators (such as `$_internalInhibitOptimization`) as generic arrays rather than sub-pipelines, causing it to skip enforcement entirely for that branch. This lets a user holding only DBViewer read permission inject `$lookup` stages inside `$facet` sub-pipelines, cross-join into restricted collections such as `members`, and extract sensitive fields including `prid` (password-reset tokens), which are directly usable for account takeover. No public exploit has been identified at time of analysis, but the GitHub PR diff exposes sufficient technical detail to reconstruct the technique.
countly-server is the server-side part of Countly, a product analytics solution. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.