MajorCritical vulnerability

CVE-2026-120815 (CVSS 8.6)

NVD · officialPublished Nov 10, 2026Risk 37/100

An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.

Technical details

CVSS

8.6

AV:LocalAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source