CVE-2026-120814
7.2 HIGHPublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-250
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2025-30046
- MEDIUMCVE-2025-54991PoC
- MEDIUMCVE-2025-55002PoC
- HIGHCVE-2026-102118PoC
- MEDIUMCVE-2026-102247PoC
- HIGHCVE-2026-104795
- HIGHCVE-2026-106378
- MEDIUMCVE-2026-107176
Related by shared AI tags and CWE weakness class. Browse the full archive.