CVE-2026-13060 — $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

CVE-2026-13060

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access PUBLISHED

Description (CNA)

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 7.0 before 7.0.39; affected 8.0 before 8.0.28; affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-863

References

https://jira.mongodb.org/browse/SERVER-127357

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.