CVE-2026-82074: Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have minimal privileges. They must be able to submit a specially formatted aggregation request to the target MongoDB Server database.
What data can be exposed?
Successful exploitation can provide unauthorized read access to collection data within the target database. The provided information does not indicate unauthorized modification or deletion of data.