Description
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MongoDB MongoDB Server
Default version status: unaffected
7.0 to < 7.0.39affected8.0 to < 8.0.28affected8.2.0 to < 8.2.12affected8.3.0 to < 8.3.7affected