Executive brief
MongoDB Server contains a flaw in how it validates permissions for the aggregation framework. An attacker with a basic database account can craft a specially formatted aggregation request that bypasses authorization checks, allowing unauthorized access to read data from collections they should not have permission to view. This could expose sensitive information stored in the database.
Technical details
The vulnerability is an incorrect authorization flaw in MongoDB's aggregation framework where the authorization subsystem evaluates a different operation than what is actually executed. An authenticated user with minimal privileges can craft a specially formatted aggregation request that exploits this mismatch, resulting in unauthorized read access to collection data within the target database. The attack requires prior authentication but no special network access; the issue has been fixed in MongoDB Server versions 7.0.41 and 8.0.30.
Affected products
- MongoDB Server before 7.0.41 and 8.0.30
Timeline
- 2026-09-08: disclosed: CVE-2026-82074 published
- 2026-08-10: patched: Fixed in versions 7.0.41 and 8.0.30
- 2026-07-27: other: Issue created (SERVER-132275)