{"id":"CVE-2026-120816","kind":"vulnerability","aliases":["CVE-2026-120816"],"related":[],"title":"Database change-notification option leaks restricted internal collections to read-only users","description":"A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification feature is derived only from the target namespace and does not account for the option, so no additional permission is required. This may result in unintended access to data stored in those internal collections.","summary":"A user with basic read-only database privileges can use an option on a server-side data-change notification feature to receive contents of internal collections they are refused on direct read. The privilege check for the feature only looks at the target namespace and ignores this option, so no extra permission is needed.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["change-notifications","database-server","other","read-only-users"],"not_affected_if":["change-notifications-unused"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:18:59+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:50:06+00:00","updated_at":"2026-11-10T21:50:06+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T21:50:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Database change-notification option leaks restricted internal collections to read-only users","impact":"medium","summary":"A user with basic read-only database privileges can use an option on a server-side data-change notification feature to receive contents of internal collections they are refused on direct read. The privilege check for the feature only looks at the target namespace and ignores this option, so no extra permission is needed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["database-server","change-notifications","read-only-users"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"read-only user reads restricted internal collection contents","analyst_note":"Identify the affected database product and its fixed versions from the NVD entry or vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-120816.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["change-notifications-unused"],"who_is_affected":"Systems where users hold basic read-tier privileges on a database that offers the server-side data-change notification feature are exposed through the notification option. The sources do not name the product or its versions, so the exact configuration that enables the option is unknown. Teams that do not use change notifications, or do not grant read-tier access to untrusted users, are likely lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.001031,"input_tokens":4561,"output_tokens":1149,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120816':17A,20A '-2026':16A,19A 'access':163C 'account':148C 'addit':154C 'basic':35B,92C 'certain':117C 'chang':3A,22B,52B,109C 'change-notif':2A,21B 'check':69B,133C 'collect':9A,60B,120C,170C 'content':57B,115C 'cve':15A,18A 'data':51B,108C,165C 'data-chang':50B,107C 'databas':1A,25B,39B,96C 'database-serv':24B 'deriv':139C 'direct':65B,129C 'extra':85B 'featur':54B,72B,111C,137C 'ignor':80B 'intern':8A,59B,119C,169C 'leak':6A 'look':74B 'may':159C 'namespac':78B,144C 'need':88B 'notif':4A,23B,53B,110C,136C 'option':5A,44B,82B,101C,151C 'permiss':86B,155C 'privileg':40B,68B,97C,132C 'read':12A,29B,37B,66B,94C,130C 'read-on':11A,36B 'read-only-us':28B 'read-tier':93C 'receiv':56B,113C 'refus':63B,126C 'requir':157C 'restrict':7A,118C 'result':160C 'server':26B,48B,105C 'server-sid':47B,104C 'side':49B,106C 'store':166C 'target':77B,143C 'tier':95C 'unintend':162C 'use':42B,99C 'user':14A,31B,33B,90C,124C","nicknames":[],"mitigations":[],"who_affected":"Systems where users hold basic read-tier privileges on a database that offers the server-side data-change notification feature are exposed through the notification option. The sources do not name the product or its versions, so the exact configuration that enables the option is unknown. Teams that do not use change notifications, or do not grant read-tier access to untrusted users, are likely lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["changenotifications","databaseserver","medium","other","readonlyusers"],"campaign_type":null,"search_a":"'-120816':17A,20A '-2026':16A,19A 'chang':3A 'change-notif':2A 'collect':9A 'cve':15A,18A 'databas':1A 'intern':8A 'leak':6A 'notif':4A 'option':5A 'read':12A 'read-on':11A 'restrict':7A 'user':14A","search_b":"'basic':35B 'chang':22B,52B 'change-notif':21B 'check':69B 'collect':60B 'content':57B 'data':51B 'data-chang':50B 'databas':25B,39B 'database-serv':24B 'direct':65B 'extra':85B 'featur':54B,72B 'ignor':80B 'intern':59B 'look':74B 'namespac':78B 'need':88B 'notif':23B,53B 'option':44B,82B 'permiss':86B 'privileg':40B,68B 'read':29B,37B,66B 'read-on':36B 'read-only-us':28B 'receiv':56B 'refus':63B 'server':26B,48B 'server-sid':47B 'side':49B 'target':77B 'use':42B 'user':31B,33B","search_c":"'access':163C 'account':148C 'addit':154C 'basic':92C 'certain':117C 'chang':109C 'check':133C 'collect':120C,170C 'content':115C 'data':108C,165C 'data-chang':107C 'databas':96C 'deriv':139C 'direct':129C 'featur':111C,137C 'intern':119C,169C 'may':159C 'namespac':144C 'notif':110C,136C 'option':101C,151C 'permiss':155C 'privileg':97C,132C 'read':94C,130C 'read-tier':93C 'receiv':113C 'refus':126C 'requir':157C 'restrict':118C 'result':160C 'server':105C 'server-sid':104C 'side':106C 'store':166C 'target':143C 'tier':95C 'unintend':162C 'use':99C 'user':90C,124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120816","severity":null,"published_at":"2026-11-10T21:18:59+00:00","modified_at":"2026-11-10T21:18:59+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}