Vulnerability record/PUBLISHED/Published Nov 10, 2026 20:19:49 UTC

CVE-2026-120823

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.

Base score2.3/ 10

SeverityLowCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsPresentAT

Privileges requiredLowPR

User interactionNoneUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritymongodb

Last updatedNov 13, 2026 20:35:00 UTC

PublishedNov 10, 2026 20:19:49 UTC

ReservedNov 2, 2026 22:54:41 UTC