CVE-2026-13059: MongoDB Server authorization bypass in query-level access controls

CVE-2026-13059 · Severity: high · CVSS 8.1 · Published 2026-07-22

A security vulnerability in MongoDB Server could allow a user with low-level access to bypass database security rules. By sending specially crafted commands, an attacker can read or modify data they are not authorized to see, potentially leading to the theft or corruption of sensitive business information. This issue affects systems using specific query-level access controls in standard configurations.

Quick answers

Is CVE-2026-13059 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13059 being exploited in the wild.
How severe is CVE-2026-13059?
High severity, with a CVSS score of 8.1, published 22 July 2026.
Which products and versions are affected?
MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7.
Is there a fix for CVE-2026-13059?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13059 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-13059?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in MongoDB Server's handling of client-supplied command parameters allows for an authorization bypass. The root cause is insufficient validation of the 'runtimeConstants.userRoles' field, which an attacker can manipulate in find, update, delete, and aggregate commands when the database is in a non-apiStrict configuration. By supplying these parameters, a low-privileged authenticated user can override role-based query-level access controls to perform unauthorized CRUD operations. The issue is addressed in MongoDB Server versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.

Affected products

  • MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7

Timeline

  • 2026-06-08: other: Internal ticket created
  • 2026-07-22: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.