CVE-2026-6915 — Flaw in the updateUser Command May Allow Unauthorized Configuration Change

CVE-2026-6915

Flaw in the updateUser Command May Allow Unauthorized Configuration Change PUBLISHED

Description (CNA)

An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.2.0 before 8.2.7; affected 8.0.0 before 8.0.21; affected 7.0.0 before 7.0.32

CWE

CWE-1284

References

https://jira.mongodb.org/browse/SERVER-119679

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.