MongoDB Server Role Drop Cleanup Bypass Vulnerability
CVE-2026-120806 Published on November 10, 2026
Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase
A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges on the target database.
Vulnerability Analysis
CVE-2026-120806 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an Insufficient Cleanup Vulnerability?
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.
CVE-2026-120806 has been classified to as an Insufficient Cleanup vulnerability or weakness.
Products Associated with CVE-2026-120806
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB Server:- Version 9.0.0 and below 9.0.7 is affected.
- Version 8.3.0 and below 8.3.16 is affected.
- Version 8.0.0 and below 8.0.37 is affected.
- Version 7.0.0 and below 7.0.48 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.