Vulnerability · Published Sep 8, 2026 · Assigned by mongodb
CVE-2026-82074Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
Medium 6.5
In plain English
A medium-severity incorrect authorization in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.0.0 – before 8.0.307.0.0 – before 7.0.41 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N