# CVE-2026-6915: An authorization flaw in the user management command could allow an authenticated user to make limited changes to…

Source: https://junglewise.ai/threats/cve-2026-6915-an-authorization-flaw-in-the-user-management-command-could-allow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-29  
License: CC BY 4.0 with a link back

CVE-2026-6915 · Severity: medium · CVSS 6.3 · Published 2026-04-29

An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

Technologies: [MongoDB](https://junglewise.ai/threats/technologies/mongodb). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-6915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6915 being exploited in the wild.

**How severe is CVE-2026-6915?** Medium severity, with a CVSS score of 6.3, published 29 April 2026.

**Which products and versions are affected?** MongoDB. The advisory does not name versions.

**Is there a fix for CVE-2026-6915?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-6915?** Check whether you run MongoDB. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- MongoDB

## Related threats

- [MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim)
- [MongoDB privilege escalation via change stream showSystemEvents](https://junglewise.ai/threats/cve-2026-120816-a-user-with-basic-read-tier-database-privileges-can-use-an)
- [MongoDB macOS TLS certificate validation bypass for IPv6](https://junglewise.ai/threats/cve-2026-120808-an-issue-exists-in-mongodb-s-macos-tls-client-implementation)
- [MongoDB resource leak in SSPI Kerberos authentication handler](https://junglewise.ai/threats/cve-2026-120804-a-flaw-exists-in-the-server-side-sspi-kerberos-authentication)
- [MongoDB use-after-free in SBE window function accumulator](https://junglewise.ai/threats/cve-2026-120803-a-use-after-free-issue-exists-in-mongodb-s-sbe-slot-based)