CVE-2026-82062: CWE-863: Incorrect Authorization in MongoDB MongoDB Server
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.
AI Analysis
Technical Summary
This vulnerability in MongoDB Server 8.3.0 involves an incorrect authorization check (CWE-863) that permits an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command. By specifying an internal replication mode value not intended for client selection, the attacker can execute container operations normally disabled in production. The flawed authorization only checks the operation's namespace rather than the actual storage target, enabling unauthorized direct writes to internal storage tables, metadata, or other collections' data.
Potential Impact
An attacker with elevated internal privileges can bypass intended feature restrictions and perform unauthorized writes to internal storage tables and metadata. This could compromise data integrity and confidentiality within the MongoDB Server instance. The vulnerability does not require user interaction and has a network attack vector with low attack complexity, but requires elevated privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict elevated internal privileges to trusted users only and monitor for unusual applyOps command usage.
CVE-2026-82062: CWE-863: Incorrect Authorization in MongoDB MongoDB Server
Description
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.
CVSS v4.0
Score 7.0high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in MongoDB Server 8.3.0 involves an incorrect authorization check (CWE-863) that permits an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command. By specifying an internal replication mode value not intended for client selection, the attacker can execute container operations normally disabled in production. The flawed authorization only checks the operation's namespace rather than the actual storage target, enabling unauthorized direct writes to internal storage tables, metadata, or other collections' data.
Potential Impact
An attacker with elevated internal privileges can bypass intended feature restrictions and perform unauthorized writes to internal storage tables and metadata. This could compromise data integrity and confidentiality within the MongoDB Server instance. The vulnerability does not require user interaction and has a network attack vector with low attack complexity, but requires elevated privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict elevated internal privileges to trusted users only and monitor for unusual applyOps command usage.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-08-27T22:52:09.745Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa03a25acd9273b49ec3637
Added to database: 09/08/2026, 16:39:01 UTC
Last enriched: 09/08/2026, 16:53:06 UTC
Last updated: 09/09/2026, 00:23:03 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.