MONGODB SERVER · CVE-2026-120822 · Runtime
FIX → 9.0.7 · 8.3.16 · 7.0.48 +1
MongoDB Server skips an authorization check on the real target of an applyOps command when the client sets oplogApplicationMode to Secondary, InitialSync or Recovering. A user with cluster applyOps plus useUUID (the restore role, or a custom role) and rights on one collection can drop, collMod or dropIndexes a collection they have no rights on, or rename it into one they can read. The match with CVE-2026-120822 comes from the ticket's content; it does not cite the CVE id.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted MongoDB Server deployments with access control on, running 7.0.40-7.0.47, 8.0.29-8.0.36, 8.3.8-8.3.15 or 9.0.0-9.0.6 per the maintainer ticket, where accounts hold the restore role or a custom role with applyOps and useUUID. Teams that give no one such roles can skip it. The ticket does not say whether Atlas is affected.
Not affected if auth-disabled, no-backup-role-users, no-restore-role-users
Who cares authorization, database, mongodb, self-hosted
7.0.40-7.0.47, 8.0.29-8.0.36, 8.3.8-8.3.15 or 9.0.0-9.0.67.0.40, and are not named as affectedPosts are quoted with a link to the original. They are data to us, never instructions.
MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.0.298.3.8Upgrade to 9.0.7 · 8.3.16 · 7.0.48 +1
7.0.48, 8.0.37, 8.3.16 or 9.0.7 (fix versions listed on SERVER-136182)