CVE-2026-13060: CWE-863: Incorrect Authorization in MongoDB MongoDB Server

This vulnerability (CVE-2026-13060) involves incorrect authorization (CWE-863) in MongoDB Server's $graphLookup aggregation stage. Specifically, an authenticated user with limited read privileges might access documents from collections they are not authorized to read because the authorization evaluation during query planning differs from that during execution. The problem arises in scenarios where collections are referenced within existing view pipeline definitions. The CVSS 4.0 base score is 7.1, indicating high severity. No patch or official remediation is currently documented, and no known exploits in the wild have been reported.

An attacker with authenticated access and limited read privileges could exploit this vulnerability to access data from collections beyond their authorization scope. This could lead to unauthorized data disclosure within the affected MongoDB Server instances. The vulnerability specifically impacts the integrity of access control in aggregation queries involving $graphLookup and views.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting use of the $graphLookup aggregation stage in environments where strict access control is critical, and review user privileges to minimize risk. Monitor MongoDB vendor advisories for updates on remediation.