# CVE-2026-120825: MongoDB Server authorization bypass in aggregation pipeline

Source: https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120825 · Severity: medium · CVSS 6.5 · Published 2026-11-10

MongoDB Server is a NoSQL database that stores and retrieves business data. An authenticated user with basic database privileges can bypass authorization checks in the aggregation pipeline to read collections they should not have access to, potentially exposing sensitive data including user credentials stored in system collections.

Technologies: [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-120825 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120825 being exploited in the wild.

**How severe is CVE-2026-120825?** Medium severity, with a CVSS score of 6.5, published 10 November 2026.

**Which products and versions are affected?** MongoDB Server before 9.0.7.

**Is there a fix for CVE-2026-120825?** Yes: fixed in MongoDB Server 9.0.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120825 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120825?** Check whether you run MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in MongoDB Server 9.0.7

## Technical details

The aggregation framework fails to validate privileges for nested operations within view definitions, specifically in $graphLookup's $_internalFromPipeline field. An authenticated user with readWriteAnyDatabase role can craft a view that leaks collections they lack read access to by nesting unauthorized pipeline stages inside $_internalFromPipeline. The privilege evaluation gap allows these nested stages to execute without proper authorization checks.

## Affected products

- MongoDB Server before 9.0.7

## Timeline

- 2026-11-10: disclosed
- 2026-11-10: patched

## References

- [https://jira.mongodb.org/browse/SERVER-136876](https://jira.mongodb.org/browse/SERVER-136876)
- [https://jira.mongodb.org/browse/SERVER-136878](https://jira.mongodb.org/browse/SERVER-136878)

## Related threats

- [MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of)
- [MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of)
- [MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource)
- [MongoDB Server use-after-free in aggregation framework](https://junglewise.ai/threats/cve-2026-120821-a-use-after-free-in-the-aggregation-framework-of-mongodb-server)
- [MongoDB Server memory exhaustion in FLE2 operation statistics](https://junglewise.ai/threats/cve-2026-120820-mongodb-server-maintains-an-in-memory-table-of-per-namespace)