CVE-2026-120815

EUVD-2026-122830
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
8.4 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
mongodbmongodb
9.0.0 ≤
𝑥
< 9.0.7
CNA
mongodbmongodb
8.3.0 ≤
𝑥
< 8.3.16
CNA
mongodbmongodb
8.0.0 ≤
𝑥
< 8.0.37
CNA
mongodbmongodb
7.0.0 ≤
𝑥
< 7.0.48
CNA
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/SERVER-134872