MONGODB SERVER · CVE-2026-120826 · Package
FIX → 9.0.7 ✓ verified
MongoDB's SERVER-137361 (Prevent users from creating view containing an internal-only stage) is fixed in 9.0.7. The CVE record says that on sharded deployments a user with only read-write privileges on one database can define a view whose processing is not fully privilege-checked; reading it may return data from other databases on the same shard. CVSS 7.1, CWE-863. No exploitation or public PoC found.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects sharded MongoDB deployments where multiple databases share a shard and some users hold basic read-write rights on a single database. Standalone or unsharded deployments are not described as affected. The sources do not list affected or fixed versions.
Not affected if non-sharded, replica-set-only, unsharded-deployment, version-below-9.0.0
Who cares authorization, mongodb, self-hosted, sharded-clusters
9.0.0 and < 9.0.7 are in the range listed in the CVE recordUpgrade to 9.0.7
Upgrade MongoDB Server to (fix version in MongoDB's SERVER-137361).
Posts are quoted with a link to the original. They are data to us, never instructions.
An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
9.0.7