CVE-2026-13061: Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13061?
The severity of CVE-2026-13061 is rated as medium with a score of 4.3.
How do I fix CVE-2026-13061?
To fix CVE-2026-13061, ensure that access controls are properly enforced in the $listSessions aggregation stage to restrict access to session metadata.
What does CVE-2026-13061 affect?
CVE-2026-13061 affects MongoDB systems by allowing authenticated users to improperly access session metadata of other users.
What information can be disclosed by CVE-2026-13061?
CVE-2026-13061 allows disclosure of session identifiers and associated usernames that should be restricted to cluster-level administrative privileges.
Who is impacted by CVE-2026-13061?
Authenticated users of a MongoDB system may be impacted by CVE-2026-13061 if proper access controls are not implemented.