CVE WatchSep 8, 2026

CVE-2026-82062

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the a

CVSS

5.5

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-863

EPSS · 30d

Not enough EPSS history yet.

Technical description

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.

Official references

jira.mongodb.orghttps://jira.mongodb.org/browse/SERVER-131138

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-702837.0 HIG

—

———Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally.2h CVE-2026-86073—

—

———n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.4h CVE-2026-820746.5 MED

—

———MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.2h CVE-2026-820736.5 MED

—

———A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.2h CVE-2026-820538.1 HIG

—

———A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.2h CVE-2026-866657.3 HIG

—

———A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.2h