{"id":"CVE-2026-120826","kind":"vulnerability","aliases":["CVE-2026-120826"],"related":[],"title":"MongoDB Server 9.0: a user with read-write on one database can create a view that exposes other databases on a sharded cluster","description":"An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.","summary":"MongoDB's SERVER-137361 (Prevent users from creating view containing an internal-only stage) is fixed in 9.0.7. The CVE record says that on sharded deployments a user with only read-write privileges on one database can define a view whose processing is not fully privilege-checked; reading it may return data from other databases on the same shard. CVSS 7.1, CWE-863. No exploitation or public PoC found.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["9.0.7"],"affected":">= 9.0.0, < 9.0.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["authorization","mongodb","package","self-hosted","sharded-clusters"],"not_affected_if":["non-sharded","replica-set-only","unsharded-deployment","version-below-9.0.0"],"how_to_check":"Sharded clusters only: run db.version() (or mongod --version) on mongos and each shard; versions >= 9.0.0 and < 9.0.7 are in the range listed in the CVE record. Also review which users hold readWrite on a single database, since that is the privilege needed.","fix":"Upgrade MongoDB Server to 9.0.7 (fix version in MongoDB's SERVER-137361).","status":"open","published_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:48:23+00:00","updated_at":"2026-11-10T21:50:21+00:00","category":"package","confidence":0.65,"triage":{"at":"2026-11-10T21:48:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: sharded views can expose data from other databases","impact":"medium","summary":"An authorization flaw in sharded deployments lets a user with read-write rights on one database define a view that bypasses privilege checks. Reading that view can return data belonging to other databases on the same shard.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mongodb","sharded-clusters"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads data from other databases on the same shard","analyst_note":"Check the MongoDB advisory for affected and fixed versions and the sharded-cluster conditions; NVD page is the only source.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unsharded-deployment"],"who_is_affected":"Affects sharded MongoDB deployments where multiple databases share a shard and some users hold basic read-write rights on a single database. Standalone or unsharded deployments are not described as affected. The sources do not list affected or fixed versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000667,"input_tokens":4548,"output_tokens":424,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the MongoDB advisory for affected and fixed versions and the sharded-cluster conditions; NVD page is the only source.","search":"'-120826':27A,30A '-137361':45B '-2026':26A,29A '-863':107B '7.1':105B '9.0':3A '9.0.7':60B 'access':164C 'aggreg':119C 'allow':129C 'author':33B,115C 'basic':134C 'belong':167C 'check':91B,156C 'cluster':24A,41B 'contain':51B 'creat':14A,49B 'cve':25A,28A,62B 'cvss':104B 'cwe':106B 'data':96B,166C 'databas':12A,20A,79B,99B,142C,170C 'defin':81B,144C 'definit':123C 'deploy':68B,127C 'exploit':109B 'expos':18A 'fix':58B 'flaw':116C 'found':113B 'fulli':88B,152C 'handl':124C 'held':171C 'hold':132C 'host':38B 'intern':54B 'internal-on':53B 'may':94B,128C,160C 'mongodb':1A,31A,34B,42B 'one':11A,78B 'packag':35B 'poc':112B 'prevent':46B 'privileg':76B,90B,138C,155C 'privilege-check':89B 'process':85B,149C 'public':111B 'read':8A,74B,92B,136C,157C 'read-writ':7A,73B,135C 'record':63B 'result':161C 'return':95B 'say':64B 'self':37B 'self-host':36B 'server':2A,32A,44B 'shard':23A,40B,67B,103B,126C,175C 'sharded-clust':39B 'singl':141C 'stage':56B 'subject':153C 'under':148C 'unintend':163C 'user':5A,47B,70B,131C 'view':16A,50B,83B,122C,146C,159C 'view-definit':121C 'whose':84B,147C 'write':9A,75B,137C","nicknames":[],"mitigations":[],"who_affected":"Affects sharded MongoDB deployments where multiple databases share a shard and some users hold basic read-write rights on a single database. Standalone or unsharded deployments are not described as affected. The sources do not list affected or fixed versions.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:50:21Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-137361","run_id":2866}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["authorization","high","mongodb","package","selfhosted","shardedclusters"],"campaign_type":null,"search_a":"'-120826':27A,30A '-2026':26A,29A '9.0':3A 'cluster':24A 'creat':14A 'cve':25A,28A 'databas':12A,20A 'expos':18A 'mongodb':1A,31A 'one':11A 'read':8A 'read-writ':7A 'server':2A,32A 'shard':23A 'user':5A 'view':16A 'write':9A","search_b":"'-137361':45B '-863':107B '7.1':105B '9.0.7':60B 'author':33B 'check':91B 'cluster':41B 'contain':51B 'creat':49B 'cve':62B 'cvss':104B 'cwe':106B 'data':96B 'databas':79B,99B 'defin':81B 'deploy':68B 'exploit':109B 'fix':58B 'found':113B 'fulli':88B 'host':38B 'intern':54B 'internal-on':53B 'may':94B 'mongodb':34B,42B 'one':78B 'packag':35B 'poc':112B 'prevent':46B 'privileg':76B,90B 'privilege-check':89B 'process':85B 'public':111B 'read':74B,92B 'read-writ':73B 'record':63B 'return':95B 'say':64B 'self':37B 'self-host':36B 'server':44B 'shard':40B,67B,103B 'sharded-clust':39B 'stage':56B 'user':47B,70B 'view':50B,83B 'whose':84B 'write':75B","search_c":"'access':164C 'aggreg':119C 'allow':129C 'author':115C 'basic':134C 'belong':167C 'check':156C 'data':166C 'databas':142C,170C 'defin':144C 'definit':123C 'deploy':127C 'flaw':116C 'fulli':152C 'handl':124C 'held':171C 'hold':132C 'may':128C,160C 'privileg':138C,155C 'process':149C 'read':136C,157C 'read-writ':135C 'result':161C 'shard':126C,175C 'singl':141C 'subject':153C 'under':148C 'unintend':163C 'user':131C 'view':122C,146C,159C 'view-definit':121C 'whose':147C 'write':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120826","severity":null,"published_at":"2026-11-10T21:19:02+00:00","modified_at":"2026-11-10T21:19:02+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120826:2866","url":"https://jira.mongodb.org/browse/SERVER-137361","severity":null,"published_at":"2026-11-10T21:50:21+00:00","modified_at":"2026-11-10T21:50:21+00:00","first_seen_at":"2026-11-10T21:50:21+00:00","fetched_at":"2026-11-10T21:50:21+00:00","note":"Primary: Jira SERVER-137361 (fix 9.0.7, Affects field blank). Affected range >=9.0.0 <9.0.7 comes from the CVE record mirror, not the ticket, so unverified. Mapping of the ticket title to this CVE is inferred from the CVE's reference link. No exploitation, no social search done. Related MongoDB CVEs same day: CVE-2026-120825 (aggregation view validation).","cites":["https://jira.mongodb.org/browse/SERVER-137361","https://hol.org/guard/security/cves/CVE-2026-120826-improper-authorization-in-mongodb-server-sharded"]}],"documents":[{"id":119292,"url":"https://jira.mongodb.org/browse/SERVER-137361","title":"SERVER-137361: Prevent users from creating view containing an internal-only stage","kind":"advisory","source":"analyst","publisher":null,"text":"Type Bug, Resolution Fixed, Priority Critical P2, Fix Version 9.0.7, Backport requested v9.0. Resolved Nov 10 2026.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119293,"url":"https://hol.org/guard/security/cves/CVE-2026-120826-improper-authorization-in-mongodb-server-sharded","title":"HOL Guard record CVE-2026-120826 (mirrors CVE List: >=9.0.0 <9.0.7, fixed 9.0.7, CWE-863, CVSS 7.1)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}