Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-13061

Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 7.0 to < 7.0.39affected
  • 8.0 to < 8.0.28affected
  • 8.3.0 to < 8.3.7affected

References