CVE-2026-82067

HighCVSS 8.1/10Last modified Sep 16, 2026

Description

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-178

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 8.3.0, < 8.3.9; >= 8.0.0, < 8.0.30; >= 7.0.0, < 7.0.41

References

https://jira.mongodb.org/browse/SERVER-131229Vendor Advisory, Issue Tracking

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820686.5A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sendi CVE-2026-820696.5A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredact CVE-2026-82077.0Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://githu CVE-2026-820706.5A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insuff CVE-2026-820718.1Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supp CVE-2026-820728.8Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-820736.5A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level CVE-2026-820746.5MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges CVE-2026-820757.5An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client th CVE-2026-820766.5An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/writ CVE-2026-820777.3An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG an CVE-2026-820789.1An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application in