CVE-2026-13059

Analyzed Analyzed - Analysis Complete

Authenticated Data Access Bypass in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13059

EUVD

EUVD-2026-47776

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.39 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.12 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user with low privileges to bypass role-based access controls and perform unauthorized reads or writes on protected data. It occurs due to insufficient validation of client-supplied command parameters in find, update, delete, and aggregate commands when apiStrict is not enabled.

Detection Guidance

To detect this vulnerability, check for unauthorized data access or modifications in non-apiStrict configurations. Review logs for unusual find, update, delete, or aggregate command executions by low-privilege users. Ensure role-based access controls are properly enforced.

Impact Analysis

An attacker with low-level access could access, modify, or delete sensitive data they are not authorized to view or change. This could lead to data breaches, data corruption, or unauthorized data exposure, depending on the system's configuration and data sensitivity.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection and privacy) or HIPAA (healthcare data security) by allowing unauthorized access to sensitive data. Organizations may face legal penalties, reputational damage, or loss of certification if such breaches occur.

Mitigation Strategies

Enable apiStrict mode to enforce strict parameter validation for commands like find, update, delete, and aggregate. Review and restrict low-privilege user permissions to prevent unauthorized data access. Monitor logs for unusual command usage patterns.

Hi! I’m here to help you understand CVE-2026-13059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70