1. Home
  2. CVE Database
  3. CVE-2026-13068
MEDIUM · 4.2

CVE-2026-13068

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for oth...

Vulnerability Description

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

CVSS Score

4.2

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
MongodbMongodb>= 7.0.0, < 7.0.39

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2026-13068?

CVE-2026-13068 is a vulnerability with a CVSS score of 4.2 (MEDIUM). An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for oth...

How severe is CVE-2026-13068?

CVE-2026-13068 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-13068?

Check the references section above for vendor advisories and patch information. Affected products include: Mongodb Mongodb.