---
id: "CVE-2026-120826"
page: "https://infrastack.ai/live/CVE-2026-120826"
kind: "vulnerability"
aliases: ["CVE-2026-120826"]
title: "MongoDB Server 9.0: a user with read-write on one database can create a view that exposes other databases on a sharded cluster"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "MongoDB Server", "fixed": ["9.0.7"], "affected": ">= 9.0.0, < 9.0.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authorization", "mongodb", "package", "self-hosted", "sharded-clusters"]
not_affected_if: ["non-sharded", "replica-set-only", "unsharded-deployment", "version-below-9.0.0"]
published_at: "2026-11-10T21:19:02+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:50:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120826", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-137361", "first_seen_at": "2026-11-10T21:50:21+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-137361", "https://hol.org/guard/security/cves/CVE-2026-120826-improper-authorization-in-mongodb-server-sharded"]}]
exploit_sources: []
---

# MongoDB Server 9.0: a user with read-write on one database can create a view that exposes other databases on a sharded cluster

Link for people: https://infrastack.ai/live/CVE-2026-120826 (this .md is for agents)

MongoDB's SERVER-137361 (Prevent users from creating view containing an internal-only stage) is fixed in 9.0.7. The CVE record says that on sharded deployments a user with only read-write privileges on one database can define a view whose processing is not fully privilege-checked; reading it may return data from other databases on the same shard. CVSS 7.1, CWE-863. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected >= 9.0.0, < 9.0.7 fixed 9.0.7

## How to check

Sharded clusters only: run db.version() (or mongod --version) on mongos and each shard; versions >= 9.0.0 and < 9.0.7 are in the range listed in the CVE record. Also review which users hold readWrite on a single database, since that is the privilege needed.

## Fix

Upgrade MongoDB Server to 9.0.7 (fix version in MongoDB's SERVER-137361).

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120826
- 2026-11-10T21:50:21+00:00 analyst https://jira.mongodb.org/browse/SERVER-137361 — Primary: Jira SERVER-137361 (fix 9.0.7, Affects field blank). Affected range >=9.0.0 <9.0.7 comes from the CVE record mirror, not the ticket, so unverified. Mapping of the ticket title to this CVE is inferred from the CVE's reference link. No exploitation, no social search done. Related MongoDB CVEs same day: CVE-2026-120825 (aggregation view validation).

## Documents

- [advisory] SERVER-137361: Prevent users from creating view containing an internal-only stage https://jira.mongodb.org/browse/SERVER-137361
- [describes] HOL Guard record CVE-2026-120826 (mirrors CVE List: >=9.0.0 <9.0.7, fixed 9.0.7, CWE-863, CVSS 7.1) https://hol.org/guard/security/cves/CVE-2026-120826-improper-authorization-in-mongodb-server-sharded

## From the sources

An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_