What happened
CVE-2026-120825 is an authorisation weakness in the aggregation framework of MongoDB Server. The flaw concerns privilege evaluation when a view definition is validated: a nested portion of the supplied pipeline is not covered by that evaluation. As a result, a view may return collection contents that an account would otherwise be refused permission to read, including stored authentication material. Exploitation requires a low-privileged account and a service reachable over a network. No user action is required; the exposed service can be attacked directly. The reported severity is medium, with an NVD score of 6.5. The weakness is classified as CWE-862. NVD analysis remains in progress, so the scope may change.
Who is affected
Organisations running MongoDB Server versions 9.0.0 to before 9.0.7 fall within the vendor-published affected range. The reported impact is unintended access to data in collections for which the account has not been granted read access. The stated impact is limited to confidentiality; the supplied CVSS vector records no impact to integrity or availability.
Recommended actions
- Apply the available fix for MongoDB Server. Consult the vendor’s information for the applicable fixed release; no fixed version number is specified in the supplied facts.
- Restrict network exposure of MongoDB Server services so that access is limited to authorised sources.
- Segment networks containing MongoDB Server services to limit direct connectivity from other network areas.
- Place access controls in front of exposed services to restrict which sources can reach them.
