CVE-2026-82073

CVE-2026-82073 is a high-severity authorization flaw (CWE-863) in the MongoDB Server aggregation framework. An authenticated user holding only limited read privileges can trigger it by issuing aggregation queries while Atlas Search features are in use; an internal command parameter that external clients can set is insufficiently validated, causing a view-level authorization check to be improperly skipped. The attacker gains access to data in collections they are not authorized to see through the view — a confidentiality-only issue, with no integrity or availability impact per the CVSS 4.0 vector. Affected organizations are those running MongoDB Server configurations that combine views with Atlas Search and grant restricted read access to users. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Patch MongoDB Server to the fixed release identified in MongoDB's official advisory for CVE-2026-82073, prioritizing clusters that use views with Atlas Search. As interim mitigation, review and tighten user roles so restricted users cannot invoke aggregation features that touch views backed by sensitive collections, and audit whether any low-privilege accounts can already read unauthorized collections. Monitor MongoDB's advisory for exact affected/fixed version ranges, since none were provided in the source data.