---
id: "CVE-2026-120825"
page: "https://infrastack.ai/live/CVE-2026-120825"
kind: "vulnerability"
aliases: ["CVE-2026-120825"]
title: "MongoDB Server 9.0: a user with basic read/write rights can read collections they lack access to through a view"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "mongodb-server", "fixed": ["9.0.7"], "affected": ">= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database", "infrastructure", "mongodb", "mongodb-9.0", "self-hosted"]
not_affected_if: ["auth-required", "not-9.0"]
published_at: "2026-11-10T21:19:02+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:51:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120825", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-136876", "first_seen_at": "2026-11-10T21:51:30+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-136876", "https://radar.offseq.com/threat/cve-2026-120825-cwe-862-missing-authorization-in-mongodb-mongodb-server-8aaf416c17dd66cc", "https://jira.mongodb.org/browse/SERVER-136878"]}]
exploit_sources: []
---

# MongoDB Server 9.0: a user with basic read/write rights can read collections they lack access to through a view

Link for people: https://infrastack.ai/live/CVE-2026-120825 (this .md is for agents)

MongoDB Server's aggregation framework fails to check privileges on a nested part of a view's pipeline, so a user with basic database rights can read collections they were never granted. The exposed data may include stored authentication material.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mongodb-server affected >= 9.0.0, < 9.0.7 fixed 9.0.7

## How to check

Run db.version() or mongod --version: MongoDB 9.0.0 through 9.0.6 with authorization enabled is in range (range from the CVE record via OffSeq/HOL; the Jira tickets list only fix version 9.0.7). Other release lines are not listed as affected or fixed. Then see which users hold broad roles such as readWriteAnyDatabase and can create views (createCollection privilege); the vendor repro uses a view whose $graphLookup carries the internal-only $_internalFromPipeline field.

## Fix

Upgrade MongoDB Server 9.0 to 9.0.7 (fix version in SERVER-136876 and SERVER-136878). No configuration workaround found in the vendor tickets.

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120825
- 2026-11-10T21:51:30+00:00 analyst https://jira.mongodb.org/browse/SERVER-136876 — Fix 9.0.7 confirmed on MongoDB Jira SERVER-136876/136878 (primary); affected range >=9.0.0 <9.0.7 only from CNA-relayed aggregators, so left unverified. No exploitation or public PoC beyond the Jira repro. Not checked on social; no check written (runtime version/role condition).

## Documents

- [advisory] SERVER-136876: $graphLookup $_internalFromPipeline should not be allowed in view definitions https://jira.mongodb.org/browse/SERVER-136876
- [describes] OffSeq: CVE-2026-120825 https://radar.offseq.com/threat/cve-2026-120825-cwe-862-missing-authorization-in-mongodb-mongodb-server-8aaf416c17dd66cc
- [fix] SERVER-136878: $graphLookup $_internalFromPipeline should be included in privilege checks https://jira.mongodb.org/browse/SERVER-136878

## From the sources

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_