Medium · published August 11, 2026
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
| Product | Versions | Fixed in |
|---|---|---|
| mongodb/mongodb | ≥ 7.0.0, < 7.0.40 | 7.0.40 |
| mongodb/mongodb | ≥ 8.0.0, < 8.0.29 | 8.0.29 |
| mongodb/mongodb | ≥ 8.2.0, ≤ 8.2.12 | — |
| mongodb/mongodb | ≥ 8.3.0, < 8.3.8 | 8.3.8 |
| mongodb/mongodb | all versions | — |
| mongodb/mongodb | all versions | — |
| mongodb/mongodb | all versions | — |