Every CVE Search/ Get API key

CVE-2019-2386

Authorization session conflation

7.1 HighFix available

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.

Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.14%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.1

Authorization session conflation

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.

Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.

Record
CVE-2019-2386
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-285
Updated
2026-11-02
EUVDEUVD-2019-12028 7.1

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.

Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.

Record
EUVD-2019-12028
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-gqrr-9cvj-jrrq 7.1

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows...

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.9; v3.6 versions prior to 3.6.13; v3.4 versions prior to 3.4.22.

Record
GHSA-gqrr-9cvj-jrrq
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-285, CWE-613
Updated
2026-11-02
NVD 7.1

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.

Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.

Record
CVE-2019-2386
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-285, CWE-613
Updated
2026-11-02
OSV 7.1

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.

Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions.

Refrain from creating user accounts with the same name as previously deleted accounts.

Record
CVE-2019-2386
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-2386 7.1

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22. Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions. Refrain from creating user accounts with the same name as previously deleted accounts.

Record
UBUNTU-CVE-2019-2386
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2022-1668117586 No score

Fix CVE(s): CVE-2019-2386

  • SECURITY UPDATE: After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones
    • debian/patches/CVE-2019-2386.patch: Validate unique User ID on UserCache hit
    • CVE-2019-2386
Record
CLSA-2022-1668117586
Updated
2026-11-02
OSVUSN-5052-1 No score

mongodb vulnerability

MongoDB would fail to properly invalidate existing sessions for deleted users. This could allow a remote authenticated attacker to gain elevated privileges if their user account was recreated with elevated privileges.

Record
USN-5052-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mongodb
TuxCare:Ubuntu:16.04
 before 1:2.6.10-0ubuntu1+tuxcare.els2
1:2.6.10-0ubuntu1+tuxcare.els2
mongodb-clients
TuxCare:Ubuntu:16.04
 before 1:2.6.10-0ubuntu1+tuxcare.els2
1:2.6.10-0ubuntu1+tuxcare.els2
mongodb-server
TuxCare:Ubuntu:16.04
 before 1:2.6.10-0ubuntu1+tuxcare.els2
1:2.6.10-0ubuntu1+tuxcare.els2
mongodb
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:2.4.6-0ubuntu51:2.4.6-0ubuntu61:2.4.8-1ubuntu11:2.4.8-21:2.4.9-11:2.4.9-1ubuntu11:2.4.9-1ubuntu21:2.4.9-1ubuntu2+esm2
 None known
mongodb
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:2.6.10-0ubuntu11:2.6.10-0ubuntu1+esm2
 None known
mongodb
Ubuntu:18.04:LTS
 before 1:3.6.3-0ubuntu1.3, plus listed versions
1:3.4.7-11:3.4.7-1ubuntu11:3.4.7-1ubuntu21:3.4.7-1ubuntu41:3.4.14-3ubuntu11:3.4.14-3ubuntu21:3.6.3-0ubuntu11:3.6.3-0ubuntu1.1
1:3.6.3-0ubuntu1.3
mongodb
Ubuntu:20.04:LTS
 before 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2, plus listed versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-2386 is a high vulnerability (CVSS 7.1) in Mongodb, published August 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in mongodb 1:2.6.10-0ubuntu1+tuxcare.els2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open