Vulnerability intelligence

CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

CVSS Score

8.6

High

EPSS — Exploit Probability

0.4%

Riskier than 32% of all CVEs · checked 2026-09-13

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories