CVE-2026-13060: mongodb from 7.0.0 (inclusive), before 7.0.39 (exclusive), from 8.0.0 (inclusive), before 8.0.28 (exclusive), from…

Affected technology

mongodb · from 7.0.0 (inclusive), before 7.0.39 (exclusive)
mongodb

mongodb · from 8.0.0 (inclusive), before 8.0.28 (exclusive)
mongodb

mongodb · from 8.2.0 (inclusive), before 8.2.12 (exclusive)
mongodb

mongodb · from 8.3.0 (inclusive), before 8.3.7 (exclusive)
mongodb

MongoDB Server · 7.0 to before 7.0.39, 8.0 to before 8.0.28, 8.2.0 to before 8.2.12, 8.3.0 to before 8.3.7
MongoDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none.