CVE-2026-120815
Received
Received - Intake
MongoDB Server Authorization Bypass Leading to Privilege Escalation
Vulnerability report for CVE-2026-120815, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-10
Last updated on: 2026-11-10
Assigner: MongoDB, Inc.
Description
Description
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| MongoDB | MongoDB Server | From 9.0.0 (inc) to 9.0.7 (exc) |
| MongoDB | MongoDB Server | From 8.3.0 (inc) to 8.3.16 (exc) |
| MongoDB | MongoDB Server | From 8.0.0 (inc) to 8.0.37 (exc) |
| MongoDB | MongoDB Server | From 7.0.0 (inc) to 7.0.48 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
