CVE-2026-82074

CVE-2026-82074 is an incorrect authorization vulnerability in the MongoDB Server aggregation framework . An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what i...

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

EUVD-2026-72916

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

CVE-2026-82073

MongoDB Server aggregation framework is affected by an improper validation vulnerability (CVE-2026-82073). When Atlas Search features are in use, an authenticated user with limited read privileges can bypass view-level authorization checks and read data from unauthorized collections by manipulati...

CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

EUVD-2026-72946

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

CVE-2026-82059

CVE-2026-82059 affects MongoDB Server , where an internal aggregation expression was incorrectly exposed to any authenticated user instead of being restricted to internal cluster operations. An attacker with read-only privileges can craft a malformed index specification within this expression to ...

CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...

EUVD-2026-72939

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

CVE-2026-82073: Incorrect Authorization

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

PT-2026-87145

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with permissions to execute aggregation pipeline stages can cause a MongoDB server mongod to crash. This occurs when the $regexFindAll expression triggers an assertion...

CVE-2026-82074: Incorrect Authorization

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...