CVE-2026-6915
Received Received - Intake

Authentication Bypass in User Management Command

Publication date: 2026-04-29

Last updated on: 2026-05-06

Assigner: MongoDB, Inc.

Description
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-29
Last Modified
2026-05-06
Generated
2026-07-06
AI Q&A
2026-04-29
EPSS Evaluated
2026-07-05
NVD
CVE-2026-6915
EUVD
EUVD-2026-26263

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongodb mongodb From 7.0.0 (inc) to 7.0.32 (exc)
mongodb mongodb From 8.0.0 (inc) to 8.0.21 (exc)
mongodb mongodb From 8.2.0 (inc) to 8.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in the user management command of a system. It allows an authenticated user to make limited changes to authentication-related data of another user account. Essentially, a user with some level of access can alter how authentication is performed for a different user, potentially affecting that user's account security.

Impact Analysis

The impact of this vulnerability is that an authenticated user could modify authentication data for other user accounts. This could lead to unauthorized changes in how those accounts authenticate, potentially allowing attackers to bypass security controls or gain unauthorized access, thereby compromising account integrity and security.

Executive Summary

This vulnerability is an authorization flaw in the user management command of a system. It allows an authenticated user to make limited changes to authentication-related data of another user account. Essentially, a user with some level of access can alter how authentication is performed for a different user, potentially bypassing intended restrictions.

Impact Analysis

The impact of this vulnerability is that an authenticated user could modify authentication data for other user accounts. This could lead to unauthorized changes in how those accounts authenticate, potentially weakening security controls, enabling unauthorized access, or disrupting normal authentication processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart