VULNERABILITY INTELLIGENCE

CVE-2026-76794

CVSS score4.6 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-08-28
Last modified2026-09-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Description

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

Weakness classification

  • cna@mongodb.com: CWE-79

Primary references