# CVE-2026-125120

Mongoose countDocuments selector-injection can bypass authorization and break app logic.

- Page: https://www.vulneraibility.com/cve/CVE-2026-125120
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-943
- Also known as: GHSA-pcrw-h46h-c93h
- Published: 2026-11-09

## Affected versions

- Automattic mongoose: affected < 6.13.11; >= 7.0.0 and < 7.8.12; >= 8.0.0 and < 8.24.3; >= 9.0.0 and < 9.9.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Query selector injection in countDocuments() allows attacker-controlled operators to alter counts and bypass authorization or application logic based on those counts.

## Action

Immediate action required

## Recommendation

Upgrade to Mongoose >=6.13.11/7.8.12/8.24.3/9.9.2 and validate/sanitize user filters.

## References

- [other] https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h
- [other] https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a
- [other] https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557
- [other] https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d
- [other] https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710
- [other] https://github.com/Automattic/mongoose/releases/tag/6.13.11
- [other] https://github.com/Automattic/mongoose/releases/tag/7.8.12
- [other] https://github.com/Automattic/mongoose/releases/tag/8.24.3
- [other] https://github.com/Automattic/mongoose/releases/tag/9.9.2

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.