Executive brief
MongoDB Server is a widely-used document database at the core of many applications' data storage. A security flaw in its aggregation framework allows an authenticated user with limited read permissions to bypass authorization checks and access data they should not be able to reach when Atlas Search is enabled. This could result in unauthorized data exposure for applications relying on view-level access controls to restrict sensitive information.
Technical details
The vulnerability is a privilege escalation affecting MongoDB Server's aggregation framework, caused by insufficient validation of the internal $_isHybridSearch parameter. An authenticated attacker can set this parameter at the top level of an aggregation request, causing a security check to be improperly skipped and allowing view-level authorization to be bypassed. The attack requires valid database credentials with at least read access, making it exploitable by insiders or accounts with overly broad permissions. The attacker can access collections they should not have permission to view. Patches are available in versions 9.1.0-rc0, 8.3.9, 9.0.0-rc2, and 9.1.0-rc1024.
Affected products
- MongoDB Server Prior to 9.1.0-rc0, 8.3.9, 9.0.0-rc2, and 9.1.0-rc1024
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released in versions 9.1.0-rc0, 8.3.9, 9.0.0-rc2, and 9.1.0-rc1024