Skip to content
OpenAdvisories
High · 8.4 CVE-2026-120815 EUVD-2026-122830GHSA-vfjp-mf5p-687x

Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Description

An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7, 8.3.0 – < 8.3.16, 8.0.0 – < 8.0.37, 7.0.0 – < 7.0.48 9.0.7

Advisories 1

References