Listen to this Post
CVE-2026-13061 is an improper access control vulnerability affecting MongoDB Server. The flaw resides in the `$listSessions` aggregation stage, a pipeline operator used to list active sessions within a MongoDB deployment. In a properly configured system, this stage is restricted to users with cluster‑level administrative privileges (e.g., `clusterAdmin` or `root` roles) because it exposes sensitive session metadata—including session identifiers (id), associated usernames (username), and activity timestamps (lastUse). This information is considered confidential as it can aid an attacker in session hijacking, user enumeration, or understanding system usage patterns.
The vulnerability arises because the `$listSessions` stage does not enforce sufficient authorization checks when invoked by an authenticated, non‑privileged user. An attacker with only basic read‑only or application‑level credentials can issue an aggregation pipeline containing `{ $listSessions: {} }` and receive the full session list of all users connected to the database. Normally, MongoDB’s role‑based access control (RBAC) would filter the output to only the caller’s own session, but due to a missing predicate or improper privilege validation, the server returns the entire set of sessions. This bypasses the intended isolation between tenants and violates the principle of least privilege.
The issue affects all MongoDB versions in the 7.0, 8.0, and 8.3 release lines prior to the patched builds. Specifically, versions 7.0.0 through 7.0.38, 8.0.0 through 8.0.27, and 8.3.0 through 8.3.6 are vulnerable. The vulnerability was assigned CWE‑863 (Incorrect Authorization) by the vendor and carries a CVSS v3.1 base score of 4.3 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the attack is network‑accessible, requires low complexity, and needs only low‑privileged credentials, but impacts only confidentiality (low) with no integrity or availability loss.
The attack is remote and can be executed without user interaction. No public exploit has been released, but the technical details are known and the exploitation is considered easy. The vulnerability was internally discovered by MongoDB and patched on July 22, 2026, with the release of versions 7.0.39, 8.0.28, and 8.3.7. Administrators are strongly advised to upgrade immediately, as any authenticated user—including application backends or compromised service accounts—could silently exfiltrate session metadata, leading to further lateral movement or session fixation attacks.
DailyCVE Form:
Platform: MongoDB
Version: 7.0.x<7.0.39/8.0.x<8.0.28/8.3.x<8.3.7
Vulnerability: Improper Access Control (CWE‑863)
Severity: Medium (CVSS 4.3)
date: 2026‑07‑22
Prediction: Patch released 2026‑07‑22
What Undercode Say:
Analytics
The following MongoDB shell commands and bash snippets can be used to assess exposure and verify the vulnerability.
Check current MongoDB version (vulnerable if < 7.0.39, < 8.0.28, or < 8.3.7)
mongod --version | grep -E "db version v([7-8].)"
Connect to the database as a low‑privileged user (e.g., read‑only)
mongo --username appuser --password secret --host <target> --authenticationDatabase admin
Attempt to list all sessions via the aggregation pipeline
use admin
db.aggregate([ { $listSessions: {} } ])
If the command returns session entries for multiple users, the system is vulnerable.
Expected safe output should only show the current user's session or an empty set.
For automated checks, a simple Python script can be used:
from pymongo import MongoClient
client = MongoClient("mongodb://appuser:secret@<target>:27017/admin")
result = client.admin.aggregate([{"$listSessions": {}}])
for session in result:
print(session) If sessions of other users appear, CVE‑2026‑13061 applies
Exploit
An attacker with valid credentials (e.g., a compromised application account) can issue the aggregation pipeline `[ { $listSessions: {} } ]` against the `admin` database. Because the stage lacks proper authorization filtering, the server returns all active session documents, each containing:
– `id` – the full session identifier (UUID)
– `username` – the user associated with the session
– `lastUse` – timestamp of the last activity
– `db` – the database against which the session was opened
This metadata can be used to enumerate valid usernames, track user activity patterns, and potentially reuse session identifiers if additional weaknesses exist in session management. The attack requires no special privileges beyond basic authentication and can be performed over the network without triggering audit logs that would normally flag privileged operations.
Protection
- Upgrade to MongoDB version 7.0.39, 8.0.28, 8.3.7, or any later release. These builds include a fix that enforces proper RBAC checks so that `$listSessions` only returns sessions belonging to the caller unless the user has explicit cluster‑admin rights.
- Apply the patch from the official MongoDB repository (commit
d579c7ad22ee6d2614ccd533d61bf3b255da747c) if building from source. - As a temporary workaround, revoke the `listSessions` privilege from any role that does not require it, and monitor audit logs for unexpected `aggregate` commands on the `admin` database with
$listSessions. - Restrict network access to the database port (27017) and enforce strong authentication to reduce the attack surface.
Impact
Successful exploitation allows a low‑privileged authenticated user to view session metadata of all other connected users, including session IDs and usernames. This breach of confidentiality can facilitate user enumeration, activity tracking, and session hijacking if the session identifiers are reused or if the attacker can combine this information with other vulnerabilities. The integrity and availability of the system remain unaffected, but the information leak undermines the security posture of multi‑tenant deployments and can serve as a stepping stone for more severe attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
