{"id":"CVE-2026-120825","published":"2026-11-10T21:19:02.333","lastModified":"2026-11-10T22:08:59.707","description":"An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-136876","tags":[]},{"url":"https://jira.mongodb.org/browse/SERVER-136878","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}