CVE-2026-87803: High severity Countly Countly Server DBViewer vulnerability
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWNSTAGEOPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated non-admin user who has DBViewer read permission can exploit it. The vulnerable path is the /o/db aggregation endpoint.
What access does an attacker need to obtain sensitive data?
The attacker must be able to submit aggregation JSON to DBViewer and use a nested $facet sub-pipeline. By including an unrecognized stage key such as $_internalInhibitOptimization, they can cause sibling forbidden stages, including $lookup, to bypass sanitization and join restricted collections.
What is the impact of successful exploitation?
Successful exploitation provides unauthorized read access to restricted collection data. The described exposed data includes password-reset tokens (prid), which can enable account takeover.