MongoDB Server: Missing authorization in aggregation view definitions
Summary
MongoDB Server versions 9.0.0 before 9.0.7 do not check all parts of an aggregation pipeline when a view definition is validated. An authenticated user with only basic database privileges can create a view that returns collection data they are not authorized to read. The CNA description states that this may expose stored authentication material. The Jira tickets include reproduction steps, and exploitation requires a valid database login.
Affected
- MongoDB Server 9.0.0 to before 9.0.7 (per the CNA record)
- Other branches (8.x, 7.x and older): Unknown.
Fixed in
- MongoDB Server 9.0.7 (listed as fix version in SERVER-136876 and SERVER-136878)
- Fix versions 9.1.0-rc0 and 9.1.0-rc1025 are also listed in SERVER-136876.
Workaround
Unknown. No vendor-published workaround found.
- Stopgap only, not from MongoDB: restrict database user privileges and review accounts that can create views or run aggregations.
Exploitation
- No known exploitation in the sources reviewed.
- Not checked against the CISA KEV catalog.
- No public proof of concept found in searches, but the Jira ticket SERVER-136876 contains reproduction steps.
Our recommendation
- Upgrade MongoDB Server to 9.0.7 or later.
- Confirm affected branches with the Jira tickets SERVER-136876 and SERVER-136878 before rollout, and do not assume other branches are safe.
- Review accounts with roles that allow view creation or aggregation, and remove unneeded ones.
- Monitor and log view creation.
- If credentials may have been exposed, rotate them and check other systems that use them.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120825 www.cve.org
- MongoDB Jira SERVER-136876 jira.mongodb.org
- MongoDB Jira SERVER-136878 jira.mongodb.org
- Strix CVE-2026-120825 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:04.
Original description (NVD)
An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.