{"id":"CVE-2026-120822","kind":"vulnerability","aliases":["CVE-2026-120822"],"related":[],"title":"MongoDB Server: users with the restore role can drop, modify or rename collections they have no rights on via applyOps","description":"MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.","summary":"MongoDB Server skips an authorization check on the real target of an applyOps command when the client sets oplogApplicationMode to Secondary, InitialSync or Recovering. A user with cluster applyOps plus useUUID (the restore role, or a custom role) and rights on one collection can drop, collMod or dropIndexes a collection they have no rights on, or rename it into one they can read. The match with CVE-2026-120822 comes from the ticket's content; it does not cite the CVE id.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":">= 7.0.40, < 7.0.48; >= 8.0.29, < 8.0.37; >= 8.3.8, < 8.3.16; >= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["authorization","database","mongodb","runtime","self-hosted"],"not_affected_if":["auth-disabled","no-backup-role-users","no-restore-role-users"],"how_to_check":"Run db.version() on each mongod and mongos. Per SERVER-136182 you are in range on 7.0.40-7.0.47, 8.0.29-8.0.36, 8.3.8-8.3.15 or 9.0.0-9.0.6. Then list users holding the restore role, or any custom role with the applyOps and useUUID actions (db.getUsers({showPrivileges:true}) on admin and each database). Without such users the issue needs a different account. The ticket ties the range to the earlier SERVER-130139 fix, so releases before 7.0.40, 8.0.29 and 8.3.8 are not named as affected. Confirm against MongoDB's CVE advisory when it appears.","fix":"Upgrade to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (fix versions listed on SERVER-136182). Until then, remove the restore role and any custom applyOps/useUUID privileges from accounts that should not read or alter every collection.","status":"open","published_at":"2026-11-10T21:19:01+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:47:45+00:00","updated_at":"2026-11-10T21:52:28+00:00","category":"runtime","confidence":0.65,"triage":{"at":"2026-11-10T21:47:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: backup-role user can read and move collections outside permissions","impact":"high","summary":"MongoDB Server may skip an authorization check on the target of a replication-related admin command, because the check depends on a value the client supplies. A user with backup and restore privileges could read and relocate collections they are not permitted to access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads and relocates collections beyond permitted access","analyst_note":"Find affected and fixed MongoDB Server versions and any configuration prerequisites in the MongoDB advisory for CVE-2026-120822; the NVD entry alone gives no ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-backup-role-users"],"who_is_affected":"Deployments of MongoDB Server where users hold backup and restore roles; the sources do not list affected versions. Teams that do not grant backup or restore privileges to users are less exposed. The sources do not say whether default configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4559,"output_tokens":464,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed MongoDB Server versions and any configuration prerequisites in the MongoDB advisory for CVE-2026-120822; the NVD entry alone gives no ranges.","search":"'-120822':23A,26A,104B '-2026':22A,25A,103B 'access':173C,179C 'actual':135C 'administr':133C 'applyop':20A,48B,64B 'author':29B,40B,123C 'backup':155C 'catalog':188C 'chang':184C 'check':41B,124C,139C 'cite':114B 'client':52B,148C 'cluster':63B 'collect':13A,78B,85B,164C,187C 'collmod':81B 'come':105B 'command':49B,134C 'condit':141C 'content':110B 'custom':72B 'cve':21A,24A,102B,116B 'data':181C 'databas':30B 'drop':9A,80B 'dropindex':83B 'hold':154C 'host':35B 'id':117B 'initialsync':57B 'match':100B 'may':120C,159C,175C 'modifi':10A 'mongodb':1A,27A,31B,36B,118C 'omit':121C 'one':77B,95B 'oplogapplicationmod':54B 'outsid':165C 'permit':171C 'plus':65B 'privileg':158C 'read':98B,161C 'real':44B 'recov':59B 'relat':132C 'reloc':163C 'renam':12A,92B 'replic':131C 'replication-rel':130C 'request':151C 'resourc':127C 'restor':6A,68B,157C 'result':176C 'right':17A,75B,89B 'role':7A,69B,73B 'runtim':32B 'secondari':56B 'self':34B 'self-host':33B 'server':2A,28A,37B,119C 'set':53B,167C 'skip':38B 'taken':145C 'target':45B,136C 'therefor':160C 'ticket':108B 'unintend':178C,183C 'user':3A,61B,153C,169C 'useuuid':66B 'valu':144C 'via':19A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MongoDB Server deployments with access control on, running 7.0.40-7.0.47, 8.0.29-8.0.36, 8.3.8-8.3.15 or 9.0.0-9.0.6 per the maintainer ticket, where accounts hold the restore role or a custom role with applyOps and useUUID. Teams that give no one such roles can skip it. The ticket does not say whether Atlas is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["authorization","database","high","mongodb","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120822':23A,26A '-2026':22A,25A 'applyop':20A 'collect':13A 'cve':21A,24A 'drop':9A 'modifi':10A 'mongodb':1A,27A 'renam':12A 'restor':6A 'right':17A 'role':7A 'server':2A,28A 'user':3A 'via':19A","search_b":"'-120822':104B '-2026':103B 'applyop':48B,64B 'author':29B,40B 'check':41B 'cite':114B 'client':52B 'cluster':63B 'collect':78B,85B 'collmod':81B 'come':105B 'command':49B 'content':110B 'custom':72B 'cve':102B,116B 'databas':30B 'drop':80B 'dropindex':83B 'host':35B 'id':117B 'initialsync':57B 'match':100B 'mongodb':31B,36B 'one':77B,95B 'oplogapplicationmod':54B 'plus':65B 'read':98B 'real':44B 'recov':59B 'renam':92B 'restor':68B 'right':75B,89B 'role':69B,73B 'runtim':32B 'secondari':56B 'self':34B 'self-host':33B 'server':37B 'set':53B 'skip':38B 'target':45B 'ticket':108B 'user':61B 'useuuid':66B","search_c":"'access':173C,179C 'actual':135C 'administr':133C 'author':123C 'backup':155C 'catalog':188C 'chang':184C 'check':124C,139C 'client':148C 'collect':164C,187C 'command':134C 'condit':141C 'data':181C 'hold':154C 'may':120C,159C,175C 'mongodb':118C 'omit':121C 'outsid':165C 'permit':171C 'privileg':158C 'read':161C 'relat':132C 'reloc':163C 'replic':131C 'replication-rel':130C 'request':151C 'resourc':127C 'restor':157C 'result':176C 'server':119C 'set':167C 'taken':145C 'target':136C 'therefor':160C 'unintend':178C,183C 'user':153C,169C 'valu':144C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120822","severity":null,"published_at":"2026-11-10T21:19:01+00:00","modified_at":"2026-11-10T21:19:01+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120822:2871","url":"https://jira.mongodb.org/browse/SERVER-136182","severity":null,"published_at":"2026-11-10T21:52:28+00:00","modified_at":"2026-11-10T21:52:28+00:00","first_seen_at":"2026-11-10T21:52:28+00:00","fetched_at":"2026-11-10T21:52:28+00:00","note":"No MongoDB advisory page found yet and NVD gives no ranges. Matching maintainer ticket SERVER-136182 (applyOps UUID-target auth check skipped when client sets oplogApplicationMode; restore role suffices) fits the description, but it does not cite the CVE id, so nothing is marked verified.","cites":["https://jira.mongodb.org/browse/SERVER-136182","https://nvd.nist.gov/vuln/detail/CVE-2026-120822"]}],"documents":[{"id":119303,"url":"https://jira.mongodb.org/browse/SERVER-136182","title":"SERVER-136182: Run applyOps UUID-target authorization check regardless of oplogApplicationMode","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119305,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120822","title":"NVD CVE-2026-120822","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}