CVE-2026-120822

MediumCVSS 6.7/10Last modified Nov 10, 2026

Description

MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1208234.3A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an acCVE-2026-1208248.8A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket documentCVE-2026-1208256.5An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileCVE-2026-1208266.5An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write CVE-2026-1208287.5A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option thatCVE-2026-120838.1The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perfCVE-2026-1208307.4A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet waCVE-2026-1208316.5A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted CVE-2026-1208326.5Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClCVE-2026-1208337.8labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with CVE-2026-1208347.3Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a tCVE-2026-1208366.5Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configur