Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-13068

MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 7.0 to < 7.0.39affected
  • 8.0 to < 8.0.28affected
  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References