High · 8.8 CVE-2025-11535 EUVD-2025-33270GHSA-w3gv-cjxr-hgj3

MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories

Published Oct 8, 2025 · Updated Feb 26, 2026 · Assigned by mongodb

Vendor: MongoDB Product: MongoDB Connector for BI

Description

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.

Affected products

Vendor	Product	Affected	Fixed
MongoDB	MongoDB Connector for BI	2.0.0 – ≤ 2.14.24	—

References

https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25