CVE-2025-6707 (GCVE-0-2025-6707)

Vulnerability from cvelistv5 – Published: 2025-06-26 14:04 – Updated: 2025-06-27 03:55
VLAI?
Summary
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.
Severity ?
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
MongoDB Inc MongoDB Server Affected: 5.0 , < 5.0.31 (custom)
Affected: 6.0 , < 6.0.24 (custom)
Affected: 7.0 , < 7.0.21 (custom)
Affected: 8.0 , < 8.0.5 (custom)
    cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:5.0.30:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:6.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.4:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-27T03:55:27.008Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:5.0.30:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.19:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.21:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.22:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:6.0.23:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.19:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.4:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "5.0.31",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.24",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.21",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.5",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-06-26T11:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5."
            }
          ],
          "value": "Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-26T14:04:46.283Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-93497"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Race condition in privilege cache invalidation cycle",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-6707",
    "datePublished": "2025-06-26T14:04:46.283Z",
    "dateReserved": "2025-06-26T11:09:08.157Z",
    "dateUpdated": "2025-06-27T03:55:27.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-6707\",\"sourceIdentifier\":\"cna@mongodb.com\",\"published\":\"2025-06-26T14:15:35.313\",\"lastModified\":\"2025-09-26T19:03:00.850\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.\"},{\"lang\":\"es\",\"value\":\"En determinadas circunstancias, una solicitud de usuario autenticado podr\u00eda ejecutarse con privilegios obsoletos tras un cambio intencionado por parte de un administrador autorizado. Este problema afecta a MongoDB Server v5.0 (versi\u00f3n anterior a la 5.0.31), MongoDB Server v6.0 (versi\u00f3n anterior a la 6.0.24), MongoDB Server v7.0 (versi\u00f3n anterior a la 7.0.21) y MongoDB Server v8.0 (versi\u00f3n anterior a la 8.0.5).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.0.31\",\"matchCriteriaId\":\"66128ED7-B1B4-44B8-9295-D27461F161EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.24\",\"matchCriteriaId\":\"CCD411CE-AD9D-4E4D-BA8C-85B20DB98CBC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.21\",\"matchCriteriaId\":\"79459776-D987-42E8-B5DE-CD20126AAB2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.0.5\",\"matchCriteriaId\":\"092AF039-4F08-4A57-AE38-FF84A0B7AEDF\"}]}]}],\"references\":[{\"url\":\"https://jira.mongodb.org/browse/SERVER-93497\",\"source\":\"cna@mongodb.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-6707\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-26T17:39:40.294844Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-26T17:39:27.727Z\"}}], \"cna\": {\"title\": \"Race condition in privilege cache invalidation cycle\", \"source\": {\"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.22:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.23:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.24:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.25:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.26:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.27:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.28:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.29:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:5.0.30:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.16:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.17:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.18:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.19:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.20:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.21:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.22:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:6.0.23:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.16:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.17:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.18:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.19:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:7.0.20:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:mongodb:mongodb:8.0.4:*:*:*:*:*:*:*\"], \"vendor\": \"MongoDB Inc\", \"product\": \"MongoDB Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\", \"lessThan\": \"5.0.31\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0\", \"lessThan\": \"6.0.24\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.0\", \"lessThan\": \"7.0.21\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.0\", \"lessThan\": \"8.0.5\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-06-26T11:09:00.000Z\", \"references\": [{\"url\": \"https://jira.mongodb.org/browse/SERVER-93497\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"shortName\": \"mongodb\", \"dateUpdated\": \"2025-06-26T14:04:46.283Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-6707\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-27T03:55:27.008Z\", \"dateReserved\": \"2025-06-26T11:09:08.157Z\", \"assignerOrgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"datePublished\": \"2025-06-26T14:04:46.283Z\", \"assignerShortName\": \"mongodb\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.