{"id":"CVE-2026-120823","kind":"vulnerability","aliases":["CVE-2026-120823"],"related":[],"title":"MongoDB Server: aggregation flaw lets any logged-in user read query configuration","description":"A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.","summary":"A missing authorization check in MongoDB Server's aggregation framework lets any user with valid credentials, including accounts with no roles, read deployment-wide query configuration data. An attacker gets configuration and schema information that should need a cluster-level privilege.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","infrastructure","mongodb","self-hosted"],"not_affected_if":["no-untrusted-accounts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:19:01+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:49:57+00:00","updated_at":"2026-11-10T21:49:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T21:49:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: aggregation flaw lets any logged-in user read query configuration","impact":"low","summary":"A missing authorization check in MongoDB Server's aggregation framework lets any user with valid credentials, including accounts with no roles, read deployment-wide query configuration data. An attacker gets configuration and schema information that should need a cluster-level privilege.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Read-only access to configuration and schema information across the deployment.","analyst_note":"Find the affected and fixed MongoDB Server versions in the MongoDB security advisory for this CVE; the NVD entry gave none.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-accounts"],"who_is_affected":"Any deployment running MongoDB Server where users hold valid credentials can be exposed, including accounts with no assigned roles. The sources do not name affected versions. Teams that run MongoDB without shared or low-privilege accounts are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4548,"output_tokens":466,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120823':16A,19A '-2026':15A,18A 'access':118C 'account':43B,90C 'aggreg':3A,34B,75C 'allow':81C 'assign':93C 'attack':55B 'author':28B,71C 'check':29B,72C 'cluster':66B,110C 'cluster-level':65B,109C 'configur':13A,52B,57B,101C,120C 'credenti':41B,87C 'cve':14A,17A 'data':53B,102C 'databas':20B 'deploy':49B,98C 'deployment-wid':48B,97C 'flaw':4A 'framework':35B,76C 'get':56B 'hold':84C 'host':25B 'includ':42B,88C 'inform':60B,123C 'infrastructur':21B 'let':5A,36B 'level':67B,111C 'log':8A 'logged-in':7A 'may':80C,114C 'miss':27B,70C 'mongodb':1A,22B,31B,78C 'need':63B 'otherwis':105C 'privileg':68B,112C 'queri':12A,51B,100C 'read':11A,47B,96C 'restrict':106C 'result':115C 'role':46B,94C 'schema':59B,122C 'self':24B 'self-host':23B 'server':2A,32B,79C 'unintend':117C 'user':10A,38B,83C 'valid':40B,86C 'wide':50B,99C","nicknames":[],"mitigations":[],"who_affected":"Any deployment running MongoDB Server where users hold valid credentials can be exposed, including accounts with no assigned roles. The sources do not name affected versions. Teams that run MongoDB without shared or low-privilege accounts are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","infrastructure","medium","mongodb","selfhosted"],"campaign_type":null,"search_a":"'-120823':16A,19A '-2026':15A,18A 'aggreg':3A 'configur':13A 'cve':14A,17A 'flaw':4A 'let':5A 'log':8A 'logged-in':7A 'mongodb':1A 'queri':12A 'read':11A 'server':2A 'user':10A","search_b":"'account':43B 'aggreg':34B 'attack':55B 'author':28B 'check':29B 'cluster':66B 'cluster-level':65B 'configur':52B,57B 'credenti':41B 'data':53B 'databas':20B 'deploy':49B 'deployment-wid':48B 'framework':35B 'get':56B 'host':25B 'includ':42B 'inform':60B 'infrastructur':21B 'let':36B 'level':67B 'miss':27B 'mongodb':22B,31B 'need':63B 'privileg':68B 'queri':51B 'read':47B 'role':46B 'schema':59B 'self':24B 'self-host':23B 'server':32B 'user':38B 'valid':40B 'wide':50B","search_c":"'access':118C 'account':90C 'aggreg':75C 'allow':81C 'assign':93C 'author':71C 'check':72C 'cluster':110C 'cluster-level':109C 'configur':101C,120C 'credenti':87C 'data':102C 'deploy':98C 'deployment-wid':97C 'framework':76C 'hold':84C 'includ':88C 'inform':123C 'level':111C 'may':80C,114C 'miss':70C 'mongodb':78C 'otherwis':105C 'privileg':112C 'queri':100C 'read':96C 'restrict':106C 'result':115C 'role':94C 'schema':122C 'server':79C 'unintend':117C 'user':83C 'valid':86C 'wide':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120823","severity":null,"published_at":"2026-11-10T21:19:01+00:00","modified_at":"2026-11-10T21:19:01+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}