{"id":"CVE-2026-120806","kind":"vulnerability","aliases":["CVE-2026-120806"],"related":[],"title":"MongoDB Server: dropAllRolesFromDatabase leaves stale role references that recreated roles inherit","description":"A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.","summary":"MongoDB's dropAllRolesFromDatabase command deletes role definitions but, because of malformed cleanup filters, leaves references to them in admin.system.users and admin.system.roles. If a role with the same name is later recreated with different privileges, users who had the old role silently gain the new privileges, with no grant or audit event. Exploitation needs authenticated database admin rights on the target database. The single-role dropRole command uses the correct filter and is not affected.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":">= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","mongodb","rbac","runtime","self-hosted"],"not_affected_if":["auth-required","default-config","managed-hosting","no-role-recreation"],"how_to_check":"Self-managed only: run db.version() and compare to the fixed versions. If below 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (matching your branch), check whether anyone has run dropAllRolesFromDatabase (or db.dropAllRoles()) and recreated roles of the same name: in admin, run db.system.users.find({'roles.db':'<db>'}) and db.system.roles.find({'roles.db':'<db>'}) and look for role names that no longer exist in db.system.roles but still appear in roles arrays. Also check 8.2 and 6.0 deployments: the sources do not list them.","fix":"Upgrade MongoDB Server to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (per branch). Until then, after dropAllRolesFromDatabase, manually remove the dangling role references from users and roles, or drop roles one at a time with dropRole. Review users holding recreated roles.","status":"open","published_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:56+00:00","updated_at":"2026-11-10T21:04:16+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-10T20:47:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: dropped roles leave stale grants that recreated roles inherit","impact":"medium","summary":"When a role is dropped in MongoDB Server, stale references to it remain in user and role documents. If a role with the same name is later recreated with different privileges, old users silently gain those privileges without an explicit grant or audit event.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"users silently gain privileges from a recreated role","analyst_note":"Find the affected and fixed MongoDB Server versions and any mitigation from the MongoDB security advisory linked from the NVD entry.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","no-role-recreation"],"who_is_affected":"Teams running MongoDB Server that use role-based access control and have administrators who drop and recreate roles. Exploitation requires an authenticated account with administrative privileges on the target database, so deployments without role-based access control or with a single administrator are lower risk. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4619,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed MongoDB Server versions and any mitigation from the MongoDB security advisory linked from the NVD entry.","search":"'-120806':14A,17A '-2026':13A,16A 'access':185C 'admin':82B 'admin.system.roles':47B 'admin.system.users':45B 'administr':188C 'affect':101B 'associ':164C 'audit':76B,180C 'authent':80B,184C 'author':118C 'cleanup':38B,115C 'command':30B,93B,110C 'correct':96B 'correspond':179C 'cve':12A,15A 'data':119C 'databas':20B,81B,87B,126C,187C,193C 'definit':33B,138C 'delet':31B 'differ':59B,161C 'document':149C 'drop':123C,134C 'dropallrolesfromdatabas':3A,29B 'droprol':92B 'due':127C 'event':77B,181C 'explicit':176C 'exploit':78B,182C 'fail':140C 'filter':39B,97B 'flaw':103C 'gain':68B 'grant':74B,177C 'host':26B 'incomplet':114C 'incorrect':129C 'inherit':11A,168C 'intern':130C 'later':56B 'lead':112C 'leav':4A,40B 'malform':37B 'manag':109C 'may':111C,166C 'mongodb':1A,18A,21B,27B,105C 'name':54B,156C 'need':79B 'new':70B,170C 'old':65B 'oper':135C 'predic':132C 'previous':163C 'privileg':60B,71B,162C,173C,189C 'queri':131C 'rbac':22B 'recreat':9A,57B,159C 'refer':7A,41B,144C 'remov':136C,142C 'requir':183C 'right':83B 'role':6A,10A,32B,50B,66B,91B,117C,121C,137C,148C,152C,171C 'runtim':23B 'self':25B 'self-host':24B 'server':2A,19A,106C 'silent':67B,167C 'singl':90B 'single-rol':89B 'stale':5A,143C 'subsequ':158C 'target':86B,192C 'use':94B 'user':61B,108C,146C,165C 'without':174C","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB Server deployments on 7.0, 8.0, 8.3 or 9.0 below the fixed versions that use custom roles and run dropAllRolesFromDatabase (db.dropAllRoles()), then recreate roles with the same names. Only someone with database admin rights can trigger it. Teams that never use that command, or have no custom roles or access control, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:04:16Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-130261","run_id":2742},"products":{"at":"2026-11-10T21:04:16Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-130261","run_id":2742}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["database","high","mongodb","rbac","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120806':14A,17A '-2026':13A,16A 'cve':12A,15A 'dropallrolesfromdatabas':3A 'inherit':11A 'leav':4A 'mongodb':1A,18A 'recreat':9A 'refer':7A 'role':6A,10A 'server':2A,19A 'stale':5A","search_b":"'admin':82B 'admin.system.roles':47B 'admin.system.users':45B 'affect':101B 'audit':76B 'authent':80B 'cleanup':38B 'command':30B,93B 'correct':96B 'databas':20B,81B,87B 'definit':33B 'delet':31B 'differ':59B 'dropallrolesfromdatabas':29B 'droprol':92B 'event':77B 'exploit':78B 'filter':39B,97B 'gain':68B 'grant':74B 'host':26B 'later':56B 'leav':40B 'malform':37B 'mongodb':21B,27B 'name':54B 'need':79B 'new':70B 'old':65B 'privileg':60B,71B 'rbac':22B 'recreat':57B 'refer':41B 'right':83B 'role':32B,50B,66B,91B 'runtim':23B 'self':25B 'self-host':24B 'silent':67B 'singl':90B 'single-rol':89B 'target':86B 'use':94B 'user':61B","search_c":"'access':185C 'administr':188C 'associ':164C 'audit':180C 'authent':184C 'author':118C 'cleanup':115C 'command':110C 'correspond':179C 'data':119C 'databas':126C,187C,193C 'definit':138C 'differ':161C 'document':149C 'drop':123C,134C 'due':127C 'event':181C 'explicit':176C 'exploit':182C 'fail':140C 'flaw':103C 'grant':177C 'incomplet':114C 'incorrect':129C 'inherit':168C 'intern':130C 'lead':112C 'manag':109C 'may':111C,166C 'mongodb':105C 'name':156C 'new':170C 'oper':135C 'predic':132C 'previous':163C 'privileg':162C,173C,189C 'queri':131C 'recreat':159C 'refer':144C 'remov':136C,142C 'requir':183C 'role':117C,121C,137C,148C,152C,171C 'server':106C 'silent':167C 'stale':143C 'subsequ':158C 'target':192C 'user':108C,146C,165C 'without':174C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120806","severity":null,"published_at":"2026-11-10T20:18:50+00:00","modified_at":"2026-11-10T20:18:50+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120806:2742","url":"https://jira.mongodb.org/browse/SERVER-130261","severity":null,"published_at":"2026-11-10T21:04:16+00:00","modified_at":"2026-11-10T21:04:16+00:00","first_seen_at":"2026-11-10T21:04:16+00:00","fetched_at":"2026-11-10T21:04:16+00:00","note":"Read MongoDB Jira SERVER-130261 (maintainer) + NVD CNA record. Bug is in dropAllRolesFromDatabase only; dropRole is correct. Fixes 7.0.48, 8.0.37, 8.3.16, 9.0.7. 8.2 and 6.0 not listed either way; unknown.","cites":["https://jira.mongodb.org/browse/SERVER-130261","https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120806"]}],"documents":[{"id":118508,"url":"https://jira.mongodb.org/browse/SERVER-130261","title":"SERVER-130261 dropAllRolesFromDatabase uses malformed cleanup predicates","kind":"advisory","source":"analyst","publisher":null,"text":"Fix Version/s: 8.3.16, 9.0.7, 8.0.37, 7.0.48. Resolved Nov 10 2026. Only dropAllRolesFromDatabase affected; dropRole uses correct $elemMatch. Cleanup filters in dropAllRolesFromDBTxnFn do not match array elements, so role docs are deleted but references remain in admin.system.users and admin.system.roles.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118509,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120806","title":"NVD record CVE-2026-120806 (CNA: MongoDB)","kind":"other","source":"analyst","publisher":null,"text":"Affected: 9.0.0-<9.0.7, 8.3.0-<8.3.16, 8.0.0-<8.0.37, 7.0.0-<7.0.48. CVSS 3.1 5.5 medium, 4.0 7.0. Requires authenticated database admin privileges on target database. CWE-459.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}