Loading...
Loading...
A missing authorization check in the updateUser command allows any authenticated user to downgrade any other user's authentication mechanism from SCRAM-SHA-256 to SCRAM-SHA-1. This is the function that is missing that check: https://github.com/10gen/mongo/blob/master/src/mongo/db/commands/user_management_commands_common.cpp#L219
xgen-internal-githook commented on Mon, 9 Mar 2026 15:27:23 +0000: Author: {'name': 'Gabriel Marks', 'email': 'gabriel.marks@mongodb.com', 'username': 'marksg07'} Message: SERVER-119679 Add auth check for updating mechanisms of user (#48178) (#48534) GitOrigin-RevId: 3e15fa285a88b114c8e4247a1979cc9b9aabe1eb Branch: v8.2 https://github.com/mongodb/mongo/commit/0b13f3b9d2c58d829dca490f0bcc1c7fce881740 xgen-internal-githook commented on Mon, 9 Mar 2026 15:18:12 +0000: Author: {'name': 'Gabriel Marks', 'email': 'gabriel.marks@mongodb.com', 'username': 'marksg07'} Message: SERVER-119679 Add auth check for updating mechanisms of user (#48178) (#48533) GitOrigin-RevId: e337a2a9c1d016397507cdbd9d059b8884343d30 Branch: v7.0 https://github.com/mongodb/mongo/commit/5d16cbfca7a6e08aafd4fbd30311ef8543051bed xgen-internal-githook commented on Mon, 9 Mar 2026 15:14:53 +0000: Author: {'name': 'Gabriel Marks', 'email': 'gabriel.marks@mongodb.com', 'username': 'marksg07'} Message: SERVER-119679 Add auth check for updating mechanisms of user (#48178) (#48532) GitOrigin-RevId: 4b8d66e1418742ead01c7aee2ebd1cceec6cf652 Branch: v8.0 https://github.com/mongodb/mongo/commit/3640fa13735a4c432ecc97e673dc7d75997d6acb xgen-internal-githook commented on Mon, 23 Feb 2026 21:29:12 +0000: Author: {'name': 'Gabriel Marks', 'email': 'gabriel.marks@mongodb.com', 'username': 'marksg07'} Message: SERVER-119679 Add auth check for updating mechanisms of user (#48178) GitOrigin-RevId: 99af087031eaa3a0b7194233680d84047de44b5d Branch: master https://github.com/mongodb/mongo/commit/c33d95e211cde7b3a64a0910ee007daeab9958c3
MongoDB Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.