CVE-2026-13059
Received Received - Intake

Authenticated Data Access Bypass in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13059
EUVD
EUVD-2026-47776

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user with low privileges to bypass role-based access controls and perform unauthorized reads or writes on protected data. It occurs due to insufficient validation of client-supplied command parameters in find, update, delete, and aggregate commands when apiStrict is not enabled.

Impact Analysis

An attacker with low-level access could access, modify, or delete sensitive data they are not authorized to view or change. This could lead to data breaches, data corruption, or unauthorized data exposure, depending on the system's configuration and data sensitivity.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection and privacy) or HIPAA (healthcare data security) by allowing unauthorized access to sensitive data. Organizations may face legal penalties, reputational damage, or loss of certification if such breaches occur.

Mitigation Strategies

Enable apiStrict mode to enforce strict parameter validation for commands like find, update, delete, and aggregate. Review and restrict low-privilege user permissions to prevent unauthorized data access. Monitor logs for unusual command usage patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart