CVE-2026-6915
Authentication Bypass in User Management Command
Publication date: 2026-04-29
Last updated on: 2026-05-06
Assigner: MongoDB, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | mongodb | From 7.0.0 (inc) to 7.0.32 (exc) |
| mongodb | mongodb | From 8.0.0 (inc) to 8.0.21 (exc) |
| mongodb | mongodb | From 8.2.0 (inc) to 8.2.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authorization flaw in the user management command of a system. It allows an authenticated user to make limited changes to authentication-related data of another user account. Essentially, a user with some level of access can alter how authentication is performed for a different user, potentially affecting that user's account security.
How can this vulnerability impact me? :
The impact of this vulnerability is that an authenticated user could modify authentication data for other user accounts. This could lead to unauthorized changes in how those accounts authenticate, potentially allowing attackers to bypass security controls or gain unauthorized access, thereby compromising account integrity and security.
Can you explain this vulnerability to me?
This vulnerability is an authorization flaw in the user management command of a system. It allows an authenticated user to make limited changes to authentication-related data of another user account. Essentially, a user with some level of access can alter how authentication is performed for a different user, potentially bypassing intended restrictions.
How can this vulnerability impact me? :
The impact of this vulnerability is that an authenticated user could modify authentication data for other user accounts. This could lead to unauthorized changes in how those accounts authenticate, potentially weakening security controls, enabling unauthorized access, or disrupting normal authentication processes.