CVE-2026-6915
published 2026-04-29CVE-2026-6915: An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with…
PriorityP427medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.17%
5.9th percentile
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.32 | 7.0.32 |
| mongodb | mongodb | >= 8.0.0 < 8.0.21 | 8.0.21 |
| mongodb | mongodb | >= 8.2.0 < 8.2.7 | 8.2.7 |
| mongodb | mongodb_server | >= 7.0.0 < 7.0.32 | 7.0.32 |
| mongodb | mongodb_server | >= 8.0.0 < 8.0.21 | 8.0.21 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.7 | 8.2.7 |
| rhceph | alloy-rhel10 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mongodb: MongoDB: Authorization flaw allows modification of other user's authentication data
vendor_redhat·2026-04-29·CVSS 5.3
CVE-2026-6915 [MEDIUM] CWE-266 mongodb: MongoDB: Authorization flaw allows modification of other user's authentication data
mongodb: MongoDB: Authorization flaw allows modification of other user's authentication data
A flaw was found in MongoDB. An authenticated user could exploit an authorization flaw in the user management command. This allows them to make limited changes to authentication-related data associated with another user account. Such modifications could affect how authentication is performed for the impacted account, potentially leading to unauthorized access or denial of service for that user.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: rhceph/alloy-rhel10 (Red Hat Ceph Storage 9) - Fix
GHSA
GHSA-fmrc-pppf-w7vf: An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associat
ghsa_unreviewed·2026-04-29
CVE-2026-6915 [MEDIUM] CWE-1284 GHSA-fmrc-pppf-w7vf: An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associat
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.
VulDB
MongoDB Server up to 7.0.31/8.0.20/8.2.6 Management Command improper validation of specified quantity in input
vuldb·2026-04-29·CVSS 5.3
CVE-2026-6915 [MEDIUM] MongoDB Server up to 7.0.31/8.0.20/8.2.6 Management Command improper validation of specified quantity in input
A vulnerability classified as critical was found in MongoDB Server up to 7.0.31/8.0.20/8.2.6. This affects an unknown function of the component Management Command Handler. The manipulation results in improper validation of specified quantity in input.
This vulnerability is reported as CVE-2026-6915. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-04-29
Published