BIT-mongodb-2026-82074
Dashboard / Vulnerabilities / BIT-mongodb-2026-82074
Summary: Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
Details: MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
References: https://jira.mongodb.org/browse/SERVER-132275, https://nvd.nist.gov/vuln/detail/CVE-2026-82074
Affected packages
Package
Name: mongodb
Purl: pkg:bitnami/mongodb
Affected ranges
Type: SEMVER
Events:
Introduced- 7.0.0
Fixed -7.0.41
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
