Executive brief
MongoDB Server is a widely used database system for storing and managing corporate data. A security flaw allows standard users to view sensitive session information that should be restricted to high-level administrators. This could allow an attacker to see who else is logged into the system, their usernames, and when they were last active, potentially aiding in further targeted attacks or unauthorized monitoring of user activity.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in MongoDB Server's $listSessions aggregation stage. While this command is intended for cluster-level administrators, a flaw allows any authenticated user with network access to the database to execute the stage and retrieve session metadata. The exposed data includes active session identifiers, associated usernames, and activity timestamps for other users on the system. The issue is addressed in MongoDB Server versions 7.0.39, 8.0.28, 8.2.13, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.3.0 < 8.3.7
Timeline
- 2026-05-27: other: Issue reported internally/created in Jira
- 2026-07-22: disclosed: CVE published