Executive brief
A security flaw in MongoDB Server allows users with limited access to view data they are not authorized to see. By using specifically crafted database queries, an attacker can bypass internal permission checks to access sensitive documents in other collections. This could lead to unauthorized data exposure and potential regulatory or privacy compliance issues.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in MongoDB Server's $graphLookup aggregation stage. The root cause is an inconsistency between the 'lite' parser used during authorization and the full parser used during execution when handling duplicate BSON keys. While the authorization parser reads the first occurrence of a field (e.g., 'from'), the execution parser overwrites it with the last occurrence. An attacker with network access and basic read privileges can exploit this by providing duplicate keys in a query, causing the database to authorize access to one collection while actually retrieving data from a different, unauthorized collection. The issue is fixed in versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2 < 8.2.12, 8.3 < 8.3.7
Timeline
- 2026-05-21: other: Issue reported internally in MongoDB Jira
- 2026-05-23: patched: Fix resolved in development branches
- 2026-07-22: disclosed: CVE published to NVD