This vulnerability (CVE-2026-13061) in MongoDB Server involves incorrect authorization (CWE-863) allowing authenticated users with limited privileges to access session metadata of other users through the $listSessions aggregation stage. The exposed information includes active session identifiers, associated usernames, and activity timestamps, which should be restricted to cluster-level administrative users. The vulnerability affects specific versions: 7.0, 8.0, and 8.3.0. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An authenticated user with limited privileges can access sensitive session metadata belonging to other users, potentially leading to information disclosure about active sessions and user activity. This exposure could aid an attacker in reconnaissance or further attacks but does not directly allow privilege escalation or session hijacking according to the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users and monitor usage of the $listSessions aggregation stage to limit exposure. Avoid granting unnecessary privileges to users who do not require access to session metadata.