CVE-2026-13061
published 2026-07-22CVE-2026-13061: An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.28%
19.2th percentile
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 7.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB Server up to 7.0.38/8.0.27/8.3.6 Aggregation listSessions privileges management
vuldb·2026-07-22·CVSS 4.3
CVE-2026-13061 [MEDIUM] MongoDB Server up to 7.0.38/8.0.27/8.3.6 Aggregation listSessions privileges management
A vulnerability labeled as problematic has been found in MongoDB Server up to 7.0.38/8.0.27/8.3.6. This affects the function listSessions of the component Aggregation. Such manipulation of the argument listSessions leads to improper privilege management.
This vulnerability is documented as CVE-2026-13061. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage.
ghsa_unreviewed·2026-07-22
CVE-2026-13061 [MEDIUM] CWE-863 An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage.
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published