Skip to content
OpenAdvisories
High USN-5052-1 1 CVE

mongodb vulnerability

Published Aug 26, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

MongoDB would fail to properly invalidate existing sessions for deleted
users. This could allow a remote authenticated attacker to gain elevated
privileges if their user account was recreated with elevated privileges.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS mongodb 1:3.6.3-0ubuntu1.3
Ubuntu · 20.04 LTS 20.04:LTS mongodb 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2

Vulnerabilities 1

  • High 7.1
    CVE-2019-2386

    Authorization session conflation

    After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB S…

    MongoDB MongoDB Server mongodb Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2019-2386