{"id":"CVE-2026-120815","kind":"vulnerability","aliases":["CVE-2026-120815"],"related":[],"title":"MongoDB Server: flawed authorization check lets local users gain admin rights","description":"An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.","summary":"MongoDB Server has an incorrect authorization check that can let an unauthenticated party with local host access obtain administrative privileges on a server with authorization enabled. An attacker could then read stored data and credentials, modify data, or take the server offline.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","mongodb","self-hosted","vendor"],"not_affected_if":["authorization-disabled","managed-hosting"],"how_to_check":"Run mongod --version and compare against MongoDB's fixed versions once published (watch the 7.0, 8.0 and 8.3 release notes and the MongoDB security bulletins for CVE-2026-120815). Exposure needs security.authorization enabled in mongod.conf and an untrusted party with a local login on the database host; also review who has shell access to the host.","fix":null,"status":"open","published_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:47:30+00:00","updated_at":"2026-11-10T20:59:48+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T20:47:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MongoDB Server: flawed authorization check lets local users gain admin rights","impact":"high","summary":"MongoDB Server has an incorrect authorization check that can let an unauthenticated party with local host access obtain administrative privileges on a server with authorization enabled. An attacker could then read stored data and credentials, modify data, or take the server offline.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["mongodb","self-hosted","databases"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains database admin rights, reads credentials, modifies or deletes data","analyst_note":"Sources give no affected or fixed MongoDB versions; check the MongoDB security advisory for CVE-2026-120815 and the NVD entry.","how_to_check":"- Run `mongod --version` to see the installed MongoDB Server version.\n- Check whether authorization is enabled in the config file (`security.authorization: enabled`).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["authorization-disabled","managed-hosting"],"who_is_affected":"Servers running MongoDB Server with authorization enabled, where someone can reach the host locally. The sources do not list the affected version ranges. Deployments with authorization disabled are not described as exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4550,"output_tokens":509,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed MongoDB versions; check the MongoDB security advisory for CVE-2026-120815 and the NVD entry.","search":"'-120815':14A,17A '-2026':13A,16A 'access':40B,84C,102C 'admin':10A 'administr':42B,87C 'allow':77C 'attack':51B 'author':4A,29B,48B,68C,74C,95C 'avail':115C 'check':5A,30B,69C 'could':52B 'credenti':58B,107C 'cve':12A,15A 'data':56B,60B,105C,111C 'databas':18B,91C 'enabl':49B,96C 'flaw':3A 'gain':9A 'host':22B,39B,83C 'incorrect':28B,67C 'let':6A,33B 'local':7A,38B,82C 'loss':113C 'may':76C,98C 'modif':109C 'modifi':59B 'mongodb':1A,19B,24B,72C 'obtain':41B,86C 'offlin':65B 'parti':36B,80C 'privileg':43B,88C 'read':54B 'result':99C 'right':11A 'self':21B 'self-host':20B 'server':2A,25B,46B,64B,73C,92C,118C 'store':55B,104C 'subsystem':75C 'take':62B 'unauthent':35B,79C 'unintend':101C,108C 'user':8A 'vendor':23B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MongoDB Server with authorization enabled, where an untrusted person or process can run code on the same host (shared servers, containers sharing a host, compromised app on the DB box). The CNA rates it local-access, no privileges needed (CVSS 4.0 8.6). Affected versions are not yet published. Managed hosting such as Atlas is likely patched by the vendor, but this is not confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databases","high","mongodb","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120815':14A,17A '-2026':13A,16A 'admin':10A 'author':4A 'check':5A 'cve':12A,15A 'flaw':3A 'gain':9A 'let':6A 'local':7A 'mongodb':1A 'right':11A 'server':2A 'user':8A","search_b":"'access':40B 'administr':42B 'attack':51B 'author':29B,48B 'check':30B 'could':52B 'credenti':58B 'data':56B,60B 'databas':18B 'enabl':49B 'host':22B,39B 'incorrect':28B 'let':33B 'local':38B 'modifi':59B 'mongodb':19B,24B 'obtain':41B 'offlin':65B 'parti':36B 'privileg':43B 'read':54B 'self':21B 'self-host':20B 'server':25B,46B,64B 'store':55B 'take':62B 'unauthent':35B 'vendor':23B","search_c":"'access':84C,102C 'administr':87C 'allow':77C 'author':68C,74C,95C 'avail':115C 'check':69C 'credenti':107C 'data':105C,111C 'databas':91C 'enabl':96C 'host':83C 'incorrect':67C 'local':82C 'loss':113C 'may':76C,98C 'modif':109C 'mongodb':72C 'obtain':86C 'parti':80C 'privileg':88C 'result':99C 'server':73C,92C,118C 'store':104C 'subsystem':75C 'unauthent':79C 'unintend':101C,108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120815","severity":null,"published_at":"2026-11-10T20:18:52+00:00","modified_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120815:2737","url":null,"severity":null,"published_at":"2026-11-10T20:59:48+00:00","modified_at":"2026-11-10T20:59:48+00:00","first_seen_at":"2026-11-10T20:59:48+00:00","fetched_at":"2026-11-10T20:59:48+00:00","note":"Published today; NVD page unreadable via web-cli, no MongoDB advisory, release note or JIRA entry names CVE-2026-120815 yet (checked mongodb.com/alerts, search). Affected/fixed versions unknown; revisit once MongoDB lists it in release notes (7.0/8.0/8.3). Nothing verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}