CVE-2026-13059

Summary

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

Affected Software

VendorProductVersion RangeStatus
MongoDBMongoDB Server7.0 < 7.0.39affected
MongoDBMongoDB Server8.0 < 8.0.28affected
MongoDBMongoDB Server8.2.0 < 8.2.12affected
MongoDBMongoDB Server8.3.0 < 8.3.7affected

Weaknesses

  • CWE-807: CWE-807: Reliance on Untrusted Inputs in a Security Decision

References