CVE-2025-6707: Race condition in privilege cache invalidation cycle
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 5.0.31 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 6.0.24 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.21 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6707?
CVE-2025-6707 is considered a medium severity vulnerability.
How do I fix CVE-2025-6707?
To fix CVE-2025-6707, upgrade MongoDB Server to version 5.0.31, 6.0.24, 7.0.21, or later.
What versions are affected by CVE-2025-6707?
CVE-2025-6707 affects MongoDB Server versions prior to 5.0.31, 6.0.24, 7.0.21, and 8.0.5.
What type of issue is CVE-2025-6707?
CVE-2025-6707 is an issue that allows authenticated user requests to execute with stale privileges after an administrator change.
Is there a workaround for CVE-2025-6707 if I cannot upgrade?
There are no documented workarounds for CVE-2025-6707; the recommended action is to perform an upgrade.