Executive brief
MongoDB Server's aggregation pipeline feature contains a flaw that could allow read-only database users to perform unauthorized write operations on collections they should not be able to modify. An attacker with legitimate read-only access could exploit an internal aggregation stage to bypass authorization checks and alter data, creating a data integrity and compliance risk.
Technical details
The vulnerability exists in MongoDB Server's aggregation framework, where an internal-use aggregation stage ($idLookup) is reachable by external clients without proper authorization validation of embedded operations. An authenticated user with only read privileges can craft a malicious aggregation pipeline to invoke this stage, bypassing authorization checks and performing write operations against collections they lack write access to. The attack requires valid database authentication but no special network access. MongoDB has patched this issue in version 8.3.8 by tightening validation of $idLookup internal fields and rejecting user-supplied $idLookup operations in pipelines.
Affected products
- MongoDB MongoDB Server before 8.3.8
Timeline
- 2026-08-11: disclosed: Published to NVD
- 2026-08-11: patched: Fix released in MongoDB Server 8.3.8