{"id":"CVE-2026-120806","aliases":[],"cve":{"records":[{"id":"CVE-2026-120806","source":"mongodb","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-02T22:54:16.355Z","published":"2026-11-10T20:05:18.025Z","modified":"2026-11-13T20:59:24.084Z"}],"publishers":[{"name":"mongodb","role":"CNA","organizationId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","modified":"2026-11-10T20:05:18.025Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T20:59:24.084Z"}],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-130261","tags":[],"source":"mongodb"}],"weaknesses":[{"id":"CWE-459","description":"CWE-459: Incomplete Cleanup","source":"mongodb"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T20:59:13.971288Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase","titleSource":"mongodb","descriptionSource":"mongodb","description":"A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.","score":7,"severity":"high","published":"2026-11-10T20:05:18.025Z","modified":"2026-11-13T20:59:24.084Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MongoDB","name":"MongoDB Server","platforms":[],"versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.7","versionType":"semver"},{"version":"8.3.0","status":"affected","lessThan":"8.3.16","versionType":"semver"},{"version":"8.0.0","status":"affected","lessThan":"8.0.37","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThan":"7.0.48","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"mongodb","url":"https://www.cve.org/CVERecord?id=CVE-2026-120806"}],"remediation":[],"references":["https://jira.mongodb.org/browse/SERVER-130261"],"sources":[{"name":"CVE","id":"CVE-2026-120806","modified":"2026-11-13T20:59:24.084Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-120806"}],"assessments":[{"source":"mongodb","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","score":7},{"source":"mongodb","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-13T21:42:28.052Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T23:35:34.232Z","attemptedAt":"2026-11-13T23:35:34.232Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T23:35:33.328Z","attemptedAt":"2026-11-13T23:35:33.328Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T23:35:34.232Z","attemptedAt":"2026-11-13T23:35:34.232Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T23:35:33.328Z","attemptedAt":"2026-11-13T23:35:33.328Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-120806","url":"https://www.first.org/epss/","probability":0.00245,"percentile":0.15905,"date":"2026-11-13","checkedAt":"2026-11-13T23:35:33.328Z"},{"source":"GitHub Advisory Database","id":"GHSA-6j54-23c6-25cx","url":"https://github.com/advisories/GHSA-6j54-23c6-25cx","modified":"2026-11-10T21:34:33Z","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","checkedAt":"2026-11-13T23:35:33.328Z"},{"source":"ENISA EUVD","id":"EUVD-2026-122888","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122888","modified":"Nov 13, 2026, 8:59:24 PM","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T23:35:34.232Z"},{"source":"NVD","id":"CVE-2026-120806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120806","modified":"2026-11-13T21:17:38.093","score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T23:35:34.232Z"},{"source":"NVD","id":"CVE-2026-120806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120806","modified":"2026-11-13T21:17:38.093","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","checkedAt":"2026-11-13T23:35:34.232Z"}],"aiSummary":{"text":"MongoDB Server versions 7.0.0 to 7.0.48, 8.0.0 to 8.0.37, 8.3.0 to 8.3.16, and 9.0.0 to 9.0.7 have a flaw in user management commands, potentially allowing incomplete cleanup of role authorization data. Exploitation requires authenticated access with database administrative privileges. This may lead to users inheriting new role privileges without an explicit grant.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-12T10:56:05.123Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-120806"}]}}