6.5Orta

CVE-2026-120826Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access

MongoDB MongoDB Server Yayım: 2026-11-10 23:22 (4 gün önce)

Açıklama

An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.

Zayıflık türü (CWE): CWE-863

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
MongoDB	MongoDB Server	9.0.0 – < 9.0.7

Kaynaklar ve yamalar

https://jira.mongodb.org/browse/SERVER-137361

CVSS puanı

6.5Orta

Kaynak: mongodb · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yok
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tüm puanlar (4)

cna	CVSS 4.0	7.1Yüksek
cna	CVSS 3.1	6.5Orta
cna@mongodb.com	CVSS 4.0	7.1Yüksek
cna@mongodb.com	CVSS 3.1	6.5Orta

EPSS (30 günde istismar olasılığı)

0.36%

tüm CVE'lerin %30'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-11-02
Yayımlandı2026-11-10 23:22
IP-DB'ye ulaştı2026-11-11 02:07
Son güncelleme2026-11-14 00:17

Numarayı veren (CNA): mongodb
NVD durumu: Awaiting Analysis

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — MongoDB

4.3Orta

CVE-2026-120819 4 gün önce

Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

MongoDB MongoDB Server

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted da…

9.0Kritik

CVE-2026-118383 4 gün önce

Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

MongoDB MongoDB Server

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpec…

7.5Yüksek

CVE-2026-120828 4 gün önce

Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage

MongoDB MongoDB Server

A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these record…

6.5Orta

CVE-2026-120825 4 gün önce

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

MongoDB MongoDB Server

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege e…

8.8Yüksek

CVE-2026-120824 4 gün önce

Post-authentication use-after-free in MongoDB Server time-series bucket validation

MongoDB MongoDB Server

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directl…

4.3Orta

CVE-2026-120823 4 gün önce

Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data

MongoDB MongoDB Server

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluste…