Executive brief
A security vulnerability in MongoDB Server could allow a user with low-level access to bypass database security rules. By sending specially crafted commands, an attacker can read or modify data they are not authorized to see, potentially leading to the theft or corruption of sensitive business information. This issue affects systems using specific query-level access controls in standard configurations.
Technical details
A vulnerability in MongoDB Server's handling of client-supplied command parameters allows for an authorization bypass. The root cause is insufficient validation of the 'runtimeConstants.userRoles' field, which an attacker can manipulate in find, update, delete, and aggregate commands when the database is in a non-apiStrict configuration. By supplying these parameters, a low-privileged authenticated user can override role-based query-level access controls to perform unauthorized CRUD operations. The issue is addressed in MongoDB Server versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-06-08: other: Internal ticket created
- 2026-07-22: disclosed: CVE published