CVE-2026-120825 | BDVDB-2026-404468 Detail

Description#

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-10Record published in the CVE List.