---
id: CVE-2026-13060
title: >-
  $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing
  Unauthorized Collection Access
summary: >-
  An authenticated user with limited read privileges may be able to access
  documents from collections they are not authorized to read, due to an
  inconsistency in how the $graphLookup aggregation stage is evaluated during
  authorization and …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: MongoDB
product: MongoDB Server
affected:
  - server >= 7.0 < 7.0.39
  - server >= 8.0 < 8.0.28
  - server >= 8.2.0 < 8.2.12
  - server >= 8.3.0 < 8.3.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-23T14:18:14.197867Z'
published: '2026-07-22'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T18:35:50.169Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13060'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-127357'
tags:
  - cve.org
epss: 0.004
epssPercentile: 0.33942
ingestedAt: '2026-09-17T19:26:25.353Z'
---

## Overview

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

## Affected

- `server >= 7.0 < 7.0.39`
- `server >= 8.0 < 8.0.28`
- `server >= 8.2.0 < 8.2.12`
- `server >= 8.3.0 < 8.3.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.