MongoDBCVE-2026-13060
MongoDB Server: improper authorization
High7.1CVE-2026-13060 · Published Jul 22, 2026 · updated Aug 5, 2026
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB Server Product | >= 7.0, < 7.0.39 | 7.0.39 |
| >= 8.0, < 8.0.28 | 8.0.28 | |
| >= 8.2.0, < 8.2.12 | 8.2.12 | |
| >= 8.3.0, < 8.3.7 | 8.3.7 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-863
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | MongoDB Server: reachable assertion | High7.1 | 7.0.39+3 more |
| Jul 22 | MongoDB Compass: command injection | High8.4 | 1.49.7 |
| Jul 22 | MongoDB Server: resource exhaustion | Medium6.9 | 7.0.39+3 more |
| Jul 22 | MongoDB Server: resource exhaustion | High7.1 | 8.2.12+1 more |
| Jul 22 | MongoDB Server: resource exhaustion | High7.1 | 8.3.7 |
| Jul 22 | MongoDB Server: out-of-bounds read | High7.1 | 7.0.39+3 more |