medium4.3
CVE-2026-13061
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage.
Impact
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Mongodb | from 7.0.0 before 7.0.39 from 8.0.0 before 8.0.28 from 8.3.0 before 8.3.7 |