CVE-2026-13059: Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13059?
The severity of CVE-2026-13059 is rated high with a score of 8.1.
How do I fix CVE-2026-13059?
To fix CVE-2026-13059, ensure proper validation of client-supplied command parameters to enforce role-based access controls.
What are the potential impacts of CVE-2026-13059?
CVE-2026-13059 may allow an authenticated low-privilege user to read or write unauthorized data due to access control bypass.
Who is affected by CVE-2026-13059?
Authenticated users with low privileges are primarily affected by CVE-2026-13059.
What commands are impacted by CVE-2026-13059?
CVE-2026-13059 affects find, update, delete, and aggregate commands that utilize role-based access controls.