CVE-2026-13061 is an authorization vulnerability where authenticated users can view session metadata belonging to other users through the $listSessions aggregation stage. This information is typically limited to users with cluster-level administrative privileges. The exposure includes active session identifiers, associated usernames, and activity timestamps, which could aid an attacker in reconnaissance or lateral movement within the system. The vulnerability is classified under CWE-863 (Incorrect Authorization). No patch or official remediation is currently documented, and no known exploits are reported in the wild.

The vulnerability allows authenticated users to bypass intended access controls and view sensitive session metadata of other users. This could lead to privacy violations and potentially assist attackers in further attacks by revealing active sessions and user activity details. However, it does not directly allow privilege escalation or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize exposure to the $listSessions aggregation stage and monitor for unusual access patterns related to session metadata queries.