CVE-2026-13060

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 7.0, < 7.0.39; >= 8.0, < 8.0.28; >= 8.2.0, < 8.2.12; >= 8.3.0, < 8.3.7

References

https://jira.mongodb.org/browse/SERVER-127357Vendor Advisory, Issue Tracking

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-130614.3An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stag CVE-2026-130626.5An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata CVE-2026-130636.5An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sen CVE-2026-130646.5Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB dep CVE-2026-130656.5A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sor CVE-2026-130666.5Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process m CVE-2026-130676.3When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the CVE-2026-130684.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a se CVE-2026-130696.5An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Enc CVE-2026-13076.5The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all v CVE-2026-130705.3A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer CVE-2026-130716.5An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute se