CVE-2026-13061

Analyzed Analyzed - Analysis Complete

Session Metadata Exposure via $listSessions Aggregation in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13061

EUVD

EUVD-2026-47800

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.39 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated user to view session metadata of other users through the $listSessions aggregation stage. Normally, this data is restricted to cluster-level administrators and includes session IDs, usernames, and timestamps.

Detection Guidance

This vulnerability involves unauthorized access to session metadata by authenticated users. Detection requires reviewing MongoDB query logs for suspicious $listSessions aggregation queries, especially those executed by non-admin users. Check for queries filtering or returning session data without proper authorization.

Impact Analysis

An attacker could exploit this to gather sensitive session information, potentially leading to unauthorized access or session hijacking. This compromises user privacy and system security.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by exposing sensitive user session data. It undermines privacy requirements and could lead to compliance violations.

Mitigation Strategies

Update MongoDB to the latest patched version immediately to address the session metadata exposure via the $listSessions aggregation stage. Restrict user privileges to the minimum required and review all active sessions for suspicious activity.

Hi! I’m here to help you understand CVE-2026-13061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70