CVE-2026-82074

MongoDB Server contains an incorrect authorization flaw (CWE-863) in its aggregation framework, rated 7.1 (High) under CVSS 4.0 with high confidentiality impact only. An authenticated user holding minimal privileges can send a specially formatted aggregation request that causes the server's authorization subsystem to evaluate permissions for a different operation than the one actually executed, bypassing access controls. The attacker gains unauthorized read access to collection data within the target database; there is no integrity or availability impact. Any MongoDB Server deployment that permits low-privileged users to issue aggregations is affected, and the specific affected and fixed version ranges are published in MongoDB's own security advisory (none were included in the data available here). Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade MongoDB Server to the patched releases identified in MongoDB's security advisory for CVE-2026-82074 as soon as your maintenance window allows, since affected version ranges are not stated in the available data. As interim hardening, limit network exposure of mongod instances, review low-privileged accounts for unnecessary access, and monitor logs for anomalous aggregation commands. Prioritize patching environments that accept connections from untrusted networks or grant database credentials to third parties, as those face the greatest risk from this authentication-required read bypass.