Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-120806 EUVD-2026-122888GHSA-6j54-23c6-25cx

Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Description

A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7, 8.3.0 – < 8.3.16, 8.0.0 – < 8.0.37, 7.0.0 – < 7.0.48 9.0.7

Advisories 1

References