This vulnerability (CVE-2026-13060) in MongoDB Server involves incorrect authorization (CWE-863) caused by an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization checks compared to execution. Authenticated users with limited read privileges might exploit this inconsistency to access documents from collections they are not authorized to read. The issue specifically impacts scenarios where collections are referenced within existing view pipeline definitions. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, and no user interaction required.

An attacker with authenticated access and limited read privileges can access unauthorized documents from collections due to the authorization inconsistency in the $graphLookup aggregation stage. This could lead to unauthorized data disclosure within the affected MongoDB Server versions. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided data. Until a patch is available, restrict authenticated user privileges carefully and avoid using vulnerable versions if possible.