Authorization Flaw in MongoDB Server by MongoDB Inc.

CVE-2026-82074

What is CVE-2026-82074?

MongoDB Server contains an incorrect authorization vulnerability within its aggregation framework. This flaw allows an authenticated user with minimal privileges to manipulate the aggregation request format, leading the server's authorization subsystem to evaluate a different operation than intended. Consequently, this results in unauthorized access to sensitive collection data within a targeted database, posing significant risks to data integrity and confidentiality.

References