MongoDb Reliance on Untrusted Inputs in a Security Decision Vulnerability (CVE-2026-13059)
Description
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.