CVE-2026-120816
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification feature is derived only from the target namespace and does not account for the option, so no additional permission is required. This may result in unintended access to data stored in those internal collections.