CVE-2026-120823

MediumCVSS 4.3/10Last modified Nov 10, 2026

Description

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1208248.8A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket documentCVE-2026-1208256.5An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileCVE-2026-1208266.5An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write CVE-2026-1208287.5A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option thatCVE-2026-120838.1The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perfCVE-2026-1208307.4A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet waCVE-2026-1208316.5A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted CVE-2026-1208326.5Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClCVE-2026-1208337.8labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with CVE-2026-1208347.3Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a tCVE-2026-1208366.5Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly ConfigurCVE-2026-1208374.3Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly Configured Access Control Sec