CVE-2026-120823
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.