MongoDBCVE-2026-82073
MongoDB Server: improper authorization
High7.1CVE-2026-82073 · Published Sep 8, 2026 · updated Sep 16, 2026
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB Server Product | >= 8.3.0, < 8.3.9 | 8.3.9 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-863
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | MongoDB Server: weakly protected credentials | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: denial of service | High7.2 | 8.3.9 |
| Sep 8 | MongoDB Server: improper authorization | High7.1 | 8.0.30+1 more |
| Sep 8 | MongoDB Server: resource exhaustion | High8.7 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: integer overflow | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: use after free | Medium6.0 | 8.3.9+2 more |