CVE-2026-82074 — Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

CVE-2026-82074

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data PUBLISHED

Description (CNA)

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.0.0 before 8.0.30; affected 7.0.0 before 7.0.41

CWE

CWE-863

References

https://jira.mongodb.org/browse/SERVER-132275

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.