CVE-2026-13060
Received Received - Intake

Authenticated Document Access in MongoDB via $graphLookup Misconfiguration

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13060
EUVD
EUVD-2026-47774

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user with limited read access to access documents from unauthorized collections. It occurs due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and execution, particularly when collections are referenced in view pipeline definitions.

Impact Analysis

An attacker could exploit this to read sensitive data they are not authorized to access, potentially leading to data breaches or unauthorized information disclosure. This could affect confidentiality and trust in the system.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection such as GDPR (privacy) and HIPAA (health data). It may result in legal penalties, loss of certification, or reputational damage.

Mitigation Strategies

Update MongoDB to the latest patched version to address the $graphLookup authorization inconsistency. Review and audit view pipeline definitions for unauthorized collection references. Restrict authenticated user privileges to the minimum required access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart