CVE-2026-82073

MediumCVSS 6.5/10Last modified Sep 16, 2026

Description

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 8.3.0, < 8.3.9

References

https://jira.mongodb.org/browse/SERVER-132125Vendor Advisory, Issue Tracking

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820746.5MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges CVE-2026-820757.5An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client th CVE-2026-820766.5An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/writ CVE-2026-820777.3An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG an CVE-2026-820789.1An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application in CVE-2026-820798.4A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wire CVE-2026-82088.9Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directo CVE-2026-820816.4wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.CVE-2026-820829.8NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS comm CVE-2026-820898.8The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a CVE-2026-82096.9Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application CVE-2026-820909.2Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application s