Info
In v2.4.6, only users with the role clusterAdmin are permitted to run the listDatabases command. In recent builds (I am running against githash 19cd20cbceccfb21fd4338a2a8d5e3ad1738581d), users without the clusterAdmin role can run listDatabases if they have either the readAnyDatabase or readWriteAnyDatabase roles.
The desired behavior is that from v2.4.6--readAnyDatabase or readWriteAnyDatabase should NOT provide listDatabases permission.
Top User Comments
schwerin commented on Mon, 7 Oct 2013 20:24:51 +0000:
This was an intentional change.
Steps to Reproduce
db.auth as a user with readAnyDatabase or readWriteAnyDatabase roles
db.runCommand({listDatabases: 1})
Expected result: command fails with "unauthorized"
Actual result: command works
