{"id":"CVE-2026-120826","published":"2026-11-10T21:19:02.517","lastModified":"2026-11-10T22:08:59.707","description":"An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-137361","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}