MongoDB Server: Incomplete role cleanup in dropAllRolesFromDatabase
Summary
A flaw in MongoDB Server's user management commands leaves stale role references in user and role documents when roles are dropped with dropAllRolesFromDatabase. If a role with the same name is later recreated with different privileges, previously linked users can silently inherit those privileges without an explicit grant or audit event. Exploitation requires authenticated access with database administrative privileges on the target database.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Default configuration: unaffected
Fixed in
- 9.0.7
- 8.3.16
- 8.0.37
- 7.0.48
Workaround
No vendor workaround published. Limit role-management rights (userAdmin, createRole, dropRole, grantRole) to the smallest possible group until the fix is applied.
Exploitation
No evidence of active exploitation found. No public proof of concept found. Unknown.
Our recommendation
- Upgrade MongoDB Server to a fixed version (9.0.7, 8.3.16, 8.0.37 or 7.0.48) in the normal maintenance cycle, sooner if the server is internet-exposed.
- Confirm that mongod instances are not reachable from the internet.
- Restrict role-management rights and avoid shared administrative accounts.
- After dropping and recreating a role, review the users previously linked to it and verify their effective privileges.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120806 www.cve.org
- MongoDB Jira ticket SERVER-130261 jira.mongodb.org
- MongoDB security alerts www.mongodb.com
- Strix CVE-2026-120806 details www.strix.ai
- CVE Threatint CVE-2026-120806 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:28.
Original description (NVD)
A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.