---
id: "CVE-2026-120816"
page: "https://infrastack.ai/live/CVE-2026-120816"
kind: "vulnerability"
aliases: ["CVE-2026-120816"]
title: "Database change-notification option leaks restricted internal collections to read-only users"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["change-notifications", "database-server", "other", "read-only-users"]
not_affected_if: ["change-notifications-unused"]
published_at: "2026-11-10T21:18:59+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:50:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120816", "first_seen_at": "2026-11-10T21:46:14+00:00"}]
exploit_sources: []
---

# Database change-notification option leaks restricted internal collections to read-only users

Link for people: https://infrastack.ai/live/CVE-2026-120816 (this .md is for agents)

A user with basic read-only database privileges can use an option on a server-side data-change notification feature to receive contents of internal collections they are refused on direct read. The privilege check for the feature only looks at the target namespace and ignores this option, so no extra permission is needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120816

## From the sources

A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification feature is derived only from the target namespace and does not account for the option, so no additional permission is required. This may result in unintended access to data stored in those internal collections.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_