CVE-2026-13061

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 7.0, < 7.0.39; >= 8.0, < 8.0.28; >= 8.3.0, < 8.3.7

References

https://jira.mongodb.org/browse/SERVER-127689Vendor Advisory, Issue Tracking

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-130626.5An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata CVE-2026-130636.5An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sen CVE-2026-130646.5Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB dep CVE-2026-130656.5A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sor CVE-2026-130666.5Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process m CVE-2026-130676.3When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the CVE-2026-130684.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a se CVE-2026-130696.5An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Enc CVE-2026-13076.5The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all v CVE-2026-130705.3A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer CVE-2026-130716.5An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute se CVE-2026-130728.1When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pip