Description

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T19:17:23.853Z",
  "pubdate": "2026-08-11T19:17:23.853Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the MongoDB Server applyOps command, affecting database management systems utilizing MongoDB Server. The vulnerability allows an authenticated user with specific non-default privileges to execute restricted data-definition operations, including modifying or dropping arbitrary collections for which the user lacks explicit manipulation permissions. The root cause stems from an authorization logic discrepancy wherein the target collection is evaluated inconsistently between the initial access control check and the execution phase of the operation. Exploitation requires authenticated access to the database alongside specific non-default privileges. The risk implications include unauthorized structural modifications to critical data stores, potential data loss, and unauthorized schema alterations across protected database namespaces. Remediation requires applying official vendor patches or adjusting privilege configurations to restrict unauthorized command execution.",
  "technicalDetails": "The vulnerability resides in the MongoDB Server applyOps command handler, which is responsible for executing a batch of database operations atomically. The vulnerable component is the authorization enforcement engine governing database-level and collection-level access controls for administrative and data-definition commands. Specifically, a logic inconsistency occurs during the processing of applyOps payloads, where the mechanism determining the target collection during the authorization validation phase diverges from the mechanism utilized during the subsequent execution phase.\nExploitation requires the attacker to possess an authenticated session on the MongoDB Server with specific, non-default privileges. The attacker crafts a malicious applyOps payload encapsulating restricted data-definition operations, such as drop or collMod commands targeting collections outside of their authorized scope. During the request lifecycle, the authorization subsystem evaluates the user permissions against a target collection derived via one logic path, incorrectly permitting the action to proceed. Upon passing this flawed access check, the command execution engine processes the operation against the actual target collection derived via a different logic path.\nThis mismatch enables privilege escalation regarding data-definition operations, bypassing intended collection-level access control lists (ACLs). The post-exploitation impact includes the unauthorized dropping of restricted collections, resulting in data destruction, or the malicious alteration of collection configurations. Network exposure depends on the database deployment configuration, typically requiring network reachability to the MongoDB port and valid credentials. Because the flaw relies on an internal validation discrepancy rather than memory corruption or injection, mitigation relies heavily on correcting the target evaluation logic within the authorization framework."
}