CVE-2026-13060 — $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLoo…
Published: 2026-07-22 · CVSS: 7.1 · CVSS 4.0
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7