{"id":"CVE-2026-119675","published":"2026-11-03T17:18:07.123","lastModified":"2026-11-03T20:00:56.300","description":"MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-706"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md","tags":[]}],"hasPoc":true,"ai":null}