CVE-2026-13060 in Server
Summary
by MITRE • 07/22/2026
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical authorization bypass issue within MongoDB's aggregation framework that allows authenticated users with limited read privileges to access documents from collections they should not be authorized to read. The flaw occurs specifically when the $graphLookup aggregation stage is processed in views that contain pipeline definitions referencing other collections. The inconsistency arises between how authorization checks are performed during the aggregation stage evaluation versus how they are enforced during actual execution, creating a window where unauthorized data access can occur.
The technical root cause stems from MongoDB's handling of the $graphLookup operator within view pipeline definitions, where the system performs authorization validation at different stages of the aggregation process. During the initial authorization check, the system may incorrectly evaluate permissions for collections referenced through $graphLookup operations, potentially allowing access to documents that should be restricted based on user privileges. This inconsistency creates a path where users can traverse collection boundaries that they would normally be blocked from accessing, effectively bypassing the intended access control mechanisms.
The operational impact of this vulnerability is significant as it undermines the fundamental security model of MongoDB's access control system. An authenticated user who possesses read permissions on one collection but not others can potentially extract data from multiple collections through a single aggregation operation that leverages $graphLookup. This presents a serious risk for environments where sensitive data is partitioned across different collections, as the vulnerability could enable unauthorized users to aggregate information from disparate data sources. The issue particularly affects database environments with complex view hierarchies and multi-collection references.
Security professionals should note this vulnerability aligns with CWE-284 (Improper Access Control) and may be categorized under ATT&CK technique T1078 (Valid Accounts) as it exploits legitimate authentication mechanisms to gain unauthorized access. The flaw particularly affects MongoDB deployments where views are heavily utilized and where $graphLookup operations are common in pipeline definitions. Organizations should immediately implement mitigations including updating to patched versions of MongoDB, reviewing view configurations to minimize cross-collection references in aggregation pipelines, and implementing additional monitoring for unusual aggregation patterns that could indicate exploitation attempts.
The recommended remediation strategy involves applying the latest security patches from MongoDB while also conducting thorough audits of existing view definitions to identify and modify any $graphLookup operations that may create unauthorized access paths. System administrators should consider implementing network-level access controls and database activity monitoring to detect potential exploitation attempts. Additionally, organizations should conduct privilege reviews to ensure users only have access to collections they require for legitimate business purposes, reducing the overall attack surface. The vulnerability demonstrates the importance of maintaining consistent authorization evaluation throughout all stages of database query processing and highlights the need for comprehensive security testing of aggregation frameworks in database systems.