CVE-2026-82074 is an incorrect authorization vulnerability (CWE-863) in MongoDB Server's aggregation framework. It allows an authenticated user with limited privileges to bypass intended access controls by submitting a specially crafted aggregation request. This causes the authorization subsystem to misinterpret the operation being performed, resulting in unauthorized read access to data collections within the affected database. The vulnerability affects MongoDB Server versions 7.0.0 and 8.0.0. The CVSS 4.0 base score is 7.1 (high severity), indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

An attacker with valid authentication and minimal privileges can read data from collections they should not have access to, violating data confidentiality within the affected MongoDB databases. There is no indication of privilege escalation beyond read access or impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict authenticated user privileges carefully and monitor for suspicious aggregation queries.