CVE-2026-13060
published 2026-07-22CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.43%
35.8th percentile
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 7.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage i
ghsa_unreviewed·2026-07-22
CVE-2026-13060 [HIGH] CWE-863 An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage i
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
VulDB
MongoDB Server up to 7.0.38/8.0.27/8.2.11/8.3.6 GraphLookup Aggregation Stage $graphLookup improper authorization
vuldb·2026-07-22·CVSS 6.5
CVE-2026-13060 [MEDIUM] MongoDB Server up to 7.0.38/8.0.27/8.2.11/8.3.6 GraphLookup Aggregation Stage $graphLookup improper authorization
A vulnerability was found in MongoDB Server up to 7.0.38/8.0.27/8.2.11/8.3.6. It has been declared as problematic. This impacts the function $graphLookup of the component GraphLookup Aggregation Stage. Executing a manipulation can lead to improper authorization.
This vulnerability is tracked as CVE-2026-13060. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published