MongoDB Server up to 6.0.23/7.0.17/8.0.5 Setting lsid permission assignment

Summaryinfo

A vulnerability was found in MongoDB Server up to 6.0.23/7.0.17/8.0.5 and classified as problematic. Affected is an unknown function of the component Setting Handler. Such manipulation of the argument lsid leads to permission assignment. This vulnerability is referenced as CVE-2025-10059. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in MongoDB Server up to 6.0.23/7.0.17/8.0.5 and classified as problematic. Affected by this issue is an unknown code of the component Setting Handler. The manipulation of the argument lsid with an unknown input leads to a permission assignment vulnerability. Using CWE to declare the problem leads to CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Impacted is availability. CVE summarizes:

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

The advisory is available at jira.mongodb.org. This vulnerability is handled as CVE-2025-10059 since 09/05/2025. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 264352 (Linux Distros Unpatched Vulnerability : CVE-2025-10059), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.0.24, 7.0.18 or 8.0.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (264352). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• Server

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11
• 6.0.12
• 6.0.13
• 6.0.14
• 6.0.15
• 6.0.16
• 6.0.17
• 6.0.18
• 6.0.19
• 6.0.20
• 6.0.21
• 6.0.22
• 6.0.23
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.0.14
• 7.0.15
• 7.0.16
• 7.0.17
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion