---
id: "CVE-2026-120822"
page: "https://infrastack.ai/live/CVE-2026-120822"
kind: "vulnerability"
aliases: ["CVE-2026-120822"]
title: "MongoDB Server: users with the restore role can drop, modify or rename collections they have no rights on via applyOps"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": ">= 7.0.40, < 7.0.48; >= 8.0.29, < 8.0.37; >= 8.3.8, < 8.3.16; >= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authorization", "database", "mongodb", "runtime", "self-hosted"]
not_affected_if: ["auth-disabled", "no-backup-role-users", "no-restore-role-users"]
published_at: "2026-11-10T21:19:01+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:52:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120822", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120822", "first_seen_at": "2026-11-10T21:52:28+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-120822", "https://jira.mongodb.org/browse/SERVER-136182"]}]
exploit_sources: []
---

# MongoDB Server: users with the restore role can drop, modify or rename collections they have no rights on via applyOps

Link for people: https://infrastack.ai/live/CVE-2026-120822 (this .md is for agents)

MongoDB Server skips an authorization check on the real target of an applyOps command when the client sets oplogApplicationMode to Secondary, InitialSync or Recovering. A user with cluster applyOps plus useUUID (the restore role, or a custom role) and rights on one collection can drop, collMod or dropIndexes a collection they have no rights on, or rename it into one they can read. The match with CVE-2026-120822 comes from the ticket's content; it does not cite the CVE id.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 7.0.40, < 7.0.48; >= 8.0.29, < 8.0.37; >= 8.3.8, < 8.3.16; >= 9.0.0, < 9.0.7 fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

Run db.version() on each mongod and mongos. Per SERVER-136182 you are in range on 7.0.40-7.0.47, 8.0.29-8.0.36, 8.3.8-8.3.15 or 9.0.0-9.0.6. Then list users holding the restore role, or any custom role with the applyOps and useUUID actions (db.getUsers({showPrivileges:true}) on admin and each database). Without such users the issue needs a different account. The ticket ties the range to the earlier SERVER-130139 fix, so releases before 7.0.40, 8.0.29 and 8.3.8 are not named as affected. Confirm against MongoDB's CVE advisory when it appears.

## Fix

Upgrade to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (fix versions listed on SERVER-136182). Until then, remove the restore role and any custom applyOps/useUUID privileges from accounts that should not read or alter every collection.

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120822
- 2026-11-10T21:52:28+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-120822 — No MongoDB advisory page found yet and NVD gives no ranges. Matching maintainer ticket SERVER-136182 (applyOps UUID-target auth check skipped when client sets oplogApplicationMode; restore role suffices) fits the description, but it does not cite the CVE id, so nothing is marked verified.

## Documents

- [describes] NVD CVE-2026-120822 https://nvd.nist.gov/vuln/detail/CVE-2026-120822
- [fix] SERVER-136182: Run applyOps UUID-target authorization check regardless of oplogApplicationMode https://jira.mongodb.org/browse/SERVER-136182

## From the sources

MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_