{"id":"CVE-2026-120825","kind":"vulnerability","aliases":["CVE-2026-120825"],"related":[],"title":"MongoDB Server 9.0: a user with basic read/write rights can read collections they lack access to through a view","description":"An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.","summary":"MongoDB Server's aggregation framework fails to check privileges on a nested part of a view's pipeline, so a user with basic database rights can read collections they were never granted. The exposed data may include stored authentication material.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongodb-server","fixed":["9.0.7"],"affected":">= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","infrastructure","mongodb","mongodb-9.0","self-hosted"],"not_affected_if":["auth-required","not-9.0"],"how_to_check":"Run db.version() or mongod --version: MongoDB 9.0.0 through 9.0.6 with authorization enabled is in range (range from the CVE record via OffSeq/HOL; the Jira tickets list only fix version 9.0.7). Other release lines are not listed as affected or fixed. Then see which users hold broad roles such as readWriteAnyDatabase and can create views (createCollection privilege); the vendor repro uses a view whose $graphLookup carries the internal-only $_internalFromPipeline field.","fix":"Upgrade MongoDB Server 9.0 to 9.0.7 (fix version in SERVER-136876 and SERVER-136878). No configuration workaround found in the vendor tickets.","status":"open","published_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:48:24+00:00","updated_at":"2026-11-10T21:51:30+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T21:48:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: authenticated users can read collections they lack access to","impact":"high","summary":"MongoDB Server's aggregation framework fails to check privileges on a nested part of a view's pipeline, so a user with basic database rights can read collections they were never granted. The exposed data may include stored authentication material.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads restricted collections, including stored credentials","analyst_note":"Find the affected and fixed MongoDB Server versions and the vendor advisory from the NVD entry, then confirm the fix and any configuration workaround.","how_to_check":"- Check the MongoDB Server version with `mongod --version` and compare it with the fixed versions in the advisory\n- List users with basic database roles and review which views exist in each database","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any deployment running MongoDB Server where users hold basic database privileges and can create or use views with aggregation pipelines. Deployments where every user has full read access or no authenticated users can skip it. The sources do not give the affected version ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4588,"output_tokens":497,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed MongoDB Server versions and the vendor advisory from the NVD entry, then confirm the fix and any configuration workaround.","search":"'-120825':22A,25A '-2026':21A,24A '-9.0':33B '9.0':3A 'access':15A,114C,151C 'aggreg':40B,82C 'allow':88C 'authent':75B,90C,156C 'author':78C 'basic':7A,59B,94C 'check':44B 'collect':12A,64B,102C 'content':100C 'cover':127C 'cve':20A,23A 'data':71B,140C,153C 'databas':29B,60B,95C,105C 'definit':122C 'evalu':117C 'expos':70B 'fail':42B 'framework':41B,83C 'grant':68B,112C 'hold':92C 'host':36B 'includ':73B,154C 'infrastructur':30B 'lack':14A 'materi':76B,157C 'may':72B,87C,147C 'mongodb':1A,27A,31B,32B,37B,85C 'mongodb-server':26A 'nest':48B,129C 'never':67B 'otherwis':144C 'part':49B 'perform':118C 'pipelin':54B,134C 'portion':130C 'privileg':45B,96C,116C 'read':11A,63B,98C,113C 'read/write':8A 'refus':145C 'result':137C,148C 'return':139C 'right':9A,61B 'self':35B 'self-host':34B 'server':2A,28A,38B,86C 'store':74B,155C 'suppli':133C 'unintend':150C 'user':5A,57B,91C,142C 'valid':124C 'view':19A,52B,121C,138C 'weak':79C","nicknames":[],"mitigations":[],"who_affected":"Self-managed MongoDB Server 9.0.0 to 9.0.6 with authentication on, where some users can create views (for example readWriteAnyDatabase) but should not read every collection. Such a user can build a view that reads other collections, including admin.system.users in the vendor repro. Skip if you run another release line, have no untrusted or limited-privilege users, or users already have full read access.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:51:30Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-136878","run_id":2869}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver"],"ptokens":["mongodb","server"],"labels":["database","high","infrastructure","mongodb","mongodb90","selfhosted"],"campaign_type":null,"search_a":"'-120825':22A,25A '-2026':21A,24A '9.0':3A 'access':15A 'basic':7A 'collect':12A 'cve':20A,23A 'lack':14A 'mongodb':1A,27A 'mongodb-server':26A 'read':11A 'read/write':8A 'right':9A 'server':2A,28A 'user':5A 'view':19A","search_b":"'-9.0':33B 'aggreg':40B 'authent':75B 'basic':59B 'check':44B 'collect':64B 'data':71B 'databas':29B,60B 'expos':70B 'fail':42B 'framework':41B 'grant':68B 'host':36B 'includ':73B 'infrastructur':30B 'materi':76B 'may':72B 'mongodb':31B,32B,37B 'nest':48B 'never':67B 'part':49B 'pipelin':54B 'privileg':45B 'read':63B 'right':61B 'self':35B 'self-host':34B 'server':38B 'store':74B 'user':57B 'view':52B","search_c":"'access':114C,151C 'aggreg':82C 'allow':88C 'authent':90C,156C 'author':78C 'basic':94C 'collect':102C 'content':100C 'cover':127C 'data':140C,153C 'databas':95C,105C 'definit':122C 'evalu':117C 'framework':83C 'grant':112C 'hold':92C 'includ':154C 'materi':157C 'may':87C,147C 'mongodb':85C 'nest':129C 'otherwis':144C 'perform':118C 'pipelin':134C 'portion':130C 'privileg':96C,116C 'read':98C,113C 'refus':145C 'result':137C,148C 'return':139C 'server':86C 'store':155C 'suppli':133C 'unintend':150C 'user':91C,142C 'valid':124C 'view':121C,138C 'weak':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120825","severity":null,"published_at":"2026-11-10T21:19:02+00:00","modified_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120825:2869","url":"https://jira.mongodb.org/browse/SERVER-136876","severity":null,"published_at":"2026-11-10T21:51:30+00:00","modified_at":"2026-11-10T21:51:30+00:00","first_seen_at":"2026-11-10T21:51:30+00:00","fetched_at":"2026-11-10T21:51:30+00:00","note":"Fix 9.0.7 confirmed on MongoDB Jira SERVER-136876/136878 (primary); affected range >=9.0.0 <9.0.7 only from CNA-relayed aggregators, so left unverified. No exploitation or public PoC beyond the Jira repro. Not checked on social; no check written (runtime version/role condition).","cites":["https://jira.mongodb.org/browse/SERVER-136876","https://jira.mongodb.org/browse/SERVER-136878","https://radar.offseq.com/threat/cve-2026-120825-cwe-862-missing-authorization-in-mongodb-mongodb-server-8aaf416c17dd66cc"]}],"documents":[{"id":119300,"url":"https://jira.mongodb.org/browse/SERVER-136876","title":"SERVER-136876: $graphLookup $_internalFromPipeline should not be allowed in view definitions","kind":"advisory","source":"analyst","publisher":null,"text":"Fix version 9.0.7, resolved Nov 10 2026. Internal-only field allowed in view definitions can be abused to read collections the user is not authorized to read. Repro: user with readWriteAnyDatabase creates a view with $graphLookup $_internalFromPipeline containing $lookup from admin.system.users and reads it. Backport requested: v9.0.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119301,"url":"https://jira.mongodb.org/browse/SERVER-136878","title":"SERVER-136878: $graphLookup $_internalFromPipeline should be included in privilege checks","kind":"other","source":"analyst","publisher":null,"text":"Fix version 9.0.7, resolved Nov 10 2026. Needed together with SERVER-136876 to abuse the issue; both fixed.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119302,"url":"https://radar.offseq.com/threat/cve-2026-120825-cwe-862-missing-authorization-in-mongodb-mongodb-server-8aaf416c17dd66cc","title":"OffSeq: CVE-2026-120825","kind":"other","source":"analyst","publisher":null,"text":"Affected >=9.0.0 <9.0.7, fixed in 9.0.7 (relays CNA record). Not known exploited.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}