CVE-2026-87803

Countly Server's DBViewer component contains an authorization bypass caused by flawed sub-pipeline detection in its aggregation stage sanitizer. When a non-admin user with DBViewer read permission submits an aggregation to the /o/db endpoint containing an unrecognized stage key (such as the MongoDB-internal $_internalInhibitOptimization) inside a nested array, the sanitizer misclassifies the branch as a generic array and skips stage stripping for sibling stages. This lets the attacker inject normally forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into collections they are not authorized to read. The attacker gains unauthorized read access to sensitive data, including password-reset tokens (prid), which can be leveraged for account takeover. The flaw is not yet listed in CISA KEV, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Update Countly Server to a patched release as specified in the vendor/Snyk advisory, and as an interim mitigation restrict DBViewer access to admins only or disable non-admin access to the /o/db aggregation endpoint. Check logs for non-admin aggregation requests containing $lookup inside $facet or the $_internalInhibitOptimization operator, and rotate password-reset tokens (prid) for users in DBViewer-enabled deployments if such queries are found.