---
id: "CVE-2026-120806"
page: "https://infrastack.ai/live/CVE-2026-120806"
kind: "vulnerability"
aliases: ["CVE-2026-120806"]
title: "MongoDB Server: dropAllRolesFromDatabase leaves stale role references that recreated roles inherit"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database", "mongodb", "rbac", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "managed-hosting", "no-role-recreation"]
published_at: "2026-11-10T20:18:50+00:00"
first_seen_at: "2026-11-10T20:46:01+00:00"
updated_at: "2026-11-10T21:04:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120806", "first_seen_at": "2026-11-10T20:46:01+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-130261", "first_seen_at": "2026-11-10T21:04:16+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-130261", "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120806"]}]
exploit_sources: []
---

# MongoDB Server: dropAllRolesFromDatabase leaves stale role references that recreated roles inherit

Link for people: https://infrastack.ai/live/CVE-2026-120806 (this .md is for agents)

MongoDB's dropAllRolesFromDatabase command deletes role definitions but, because of malformed cleanup filters, leaves references to them in admin.system.users and admin.system.roles. If a role with the same name is later recreated with different privileges, users who had the old role silently gain the new privileges, with no grant or audit event. Exploitation needs authenticated database admin rights on the target database. The single-role dropRole command uses the correct filter and is not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 7.0.0, < 7.0.48; >= 8.0.0, < 8.0.37; >= 8.3.0, < 8.3.16; >= 9.0.0, < 9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

Self-managed only: run db.version() and compare to the fixed versions. If below 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (matching your branch), check whether anyone has run dropAllRolesFromDatabase (or db.dropAllRoles()) and recreated roles of the same name: in admin, run db.system.users.find({'roles.db':'<db>'}) and db.system.roles.find({'roles.db':'<db>'}) and look for role names that no longer exist in db.system.roles but still appear in roles arrays. Also check 8.2 and 6.0 deployments: the sources do not list them.

## Fix

Upgrade MongoDB Server to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (per branch). Until then, after dropAllRolesFromDatabase, manually remove the dangling role references from users and roles, or drop roles one at a time with dropRole. Review users holding recreated roles.

## Timeline

- 2026-11-10T20:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120806
- 2026-11-10T21:04:16+00:00 analyst https://jira.mongodb.org/browse/SERVER-130261 — Read MongoDB Jira SERVER-130261 (maintainer) + NVD CNA record. Bug is in dropAllRolesFromDatabase only; dropRole is correct. Fixes 7.0.48, 8.0.37, 8.3.16, 9.0.7. 8.2 and 6.0 not listed either way; unknown.

## Documents

- [advisory] SERVER-130261 dropAllRolesFromDatabase uses malformed cleanup predicates https://jira.mongodb.org/browse/SERVER-130261
- [describes] NVD record CVE-2026-120806 (CNA: MongoDB) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120806

## From the sources

A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_