CVE-2026-13060: MongoDB

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

Affected products

• MongoDB MongoDB: from 7.0.0, before 7.0.39 (fixed in 7.0.39); from 8.0.0, before 8.0.28 (fixed in 8.0.28); from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 8.3.0, before 8.3.7 (fixed in 8.3.7)

Published 2026-07-22. Last modified 2026-08-05.