CVE-2026-13060: $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13060?
CVE-2026-13060 has a medium severity rating of 6.5.
What specific risks does CVE-2026-13060 pose?
CVE-2026-13060 allows an authenticated user with limited read privileges to access documents from unauthorized collections.
How do I fix CVE-2026-13060?
To mitigate CVE-2026-13060, ensure proper authorization checks are implemented around the $graphLookup aggregation stage.
What kind of exploitation is possible with CVE-2026-13060?
Exploitation of CVE-2026-13060 can lead to unauthorized data disclosure for certain collections within the database.
Who is affected by CVE-2026-13060?
CVE-2026-13060 affects authenticated users with limited read privileges in MongoDB environments utilizing the $graphLookup aggregation stage.