CVE-2026-87803

    Dashboard / Vulnerabilities / CVE-2026-87803

    CVE-2026-87803

    Published: 10 Sept 2026Last Modified: 12 Sept 2026

    Summary:

    Details: An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87803.json, https://nvd.nist.gov/vuln/detail/CVE-2026-87803, https://github.com/Countly/countly-server/pull/7868

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -97f707c495de04766f50875cee08429648149d91

    Affected versions

    25.03.51
    25.03.50
    25.03.49
    25.03.48
    25.03.47
    25.03.46
    25.03.45
    25.03.44
    25.03.43
    25.03.42
    25.03.41
    25.03.40
    25.03.39
    25.03.38
    25.03.37
    25.03.36
    25.03.35
    25.03.34
    25.03.29
    25.03.33
    25.03.31
    25.03.30
    25.03.28
    25.03.27
    25.03.26
    25.03.25
    25.03.24
    25.03.23
    25.03.22
    25.03.21
    25.03.20
    25.03.19
    25.03.18
    25.03.17
    25.03.16
    25.03.15.test
    25.03.15
    25.03.14
    25.03.13
    25.03.12
    25.03.11
    25.03.5
    25.03.4
    25.03.3
    25.03.2
    25.03.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-87803 | CVE-DB