CVE-2026-13060

Analyzed Analyzed - Analysis Complete

Authenticated Document Access in MongoDB via $graphLookup Misconfiguration

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13060

EUVD

EUVD-2026-47774

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.39 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.12 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user with limited read access to access documents from unauthorized collections. It occurs due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and execution, particularly when collections are referenced in view pipeline definitions.

Detection Guidance

Detection requires checking MongoDB configurations for $graphLookup usage in view pipelines. Review pipeline definitions for unauthorized collection references. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to read sensitive data they are not authorized to access, potentially leading to data breaches or unauthorized information disclosure. This could affect confidentiality and trust in the system.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection such as GDPR (privacy) and HIPAA (health data). It may result in legal penalties, loss of certification, or reputational damage.

Mitigation Strategies

Update MongoDB to the latest patched version to address the $graphLookup authorization inconsistency. Review and audit view pipeline definitions for unauthorized collection references. Restrict authenticated user privileges to the minimum required access.

Hi! I’m here to help you understand CVE-2026-13060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70