PT-2025-26972 · Mongodb+2 · Mongodb Server+3

Published 2025-06-26 · Updated 2025-09-16 · CVE-2025-6707

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 5.0.31 MongoDB Server versions prior to 6.0.24 MongoDB Server versions prior to 7.0.21 MongoDB Server versions prior to 8.0.5

Description: The issue allows an authenticated user request to execute with stale privileges following an intentional change by an authorized administrator.

Recommendations: For MongoDB Server versions prior to 5.0.31, update to version 5.0.31 or later. For MongoDB Server versions prior to 6.0.24, update to version 6.0.24 or later. For MongoDB Server versions prior to 7.0.21, update to version 7.0.21 or later. For MongoDB Server versions prior to 8.0.5, update to version 8.0.5 or later.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2025-8810

ALT-PU-2025-9742

ALT-PU-2025-9750

ALT-PU-2025-9809

BDU:2025-11759

BIT-MONGODB-2025-6707

CVE-2025-6707

Affected Products

Alt Linux

Mongodb Server

Mongodb

Red Os

References · 15

• https://jira.mongodb.org/browse/SERVER-93497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6707 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2025-6707 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6707 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6707 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6707 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11759 · Security Note
• https://ubuntu.com/security/CVE-2025-6707 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cveNotify/135474 · Telegram Post
• https://t.me/cvetracker/27127 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6707 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-mongodb-org-060820251 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-mongodb-org-060820252 · Note
• https://twitter.com/CVEnew/status/1938245445869805797 · Twitter Post