CVE-2026-120819

MediumCVSS 4.3/10Last modified Nov 10, 2026

Description

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-120827.5The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthent CVE-2026-1208204.3MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are c CVE-2026-1208216.5A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipel CVE-2026-1208226.7MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because t CVE-2026-1208234.3A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an ac CVE-2026-1208248.8A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document CVE-2026-1208256.5An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privile CVE-2026-1208266.5An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write CVE-2026-1208287.5A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that CVE-2026-120838.1The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perf CVE-2026-1208307.4A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet wa CVE-2026-1208316.5A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted