CVE-2025-6713

HIGH

MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-6713 has a selected CVSS score of 7.7 (high); EIP currently links 1 repository PoC.

Description

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 7, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB Inc / MongoDB Server

Default status: unaffected

CVE List6.0 to < 6.0.22affected
7.0 to < 7.0.19affected
8.0 to < 8.0.7affected

Proofs of concept

1

Repository PoCs

GitHubc137req/CVE-2025-6713Repository PoCby c137req1Scanner4 files

4.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that connects to a MongoDB instance, sets up test data in two collections, and executes an aggregation pipeline containing a $mergeCursors stage. It prints the results and checks for an 'not authorised' error to determine if the PoC succeeded or failed, functioning as a vulnerability scanner rather than a weaponized exploit.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the CVE-2025-6713 vulnerability by using a crafted aggregation pipeline with $mergeCursors to read data from a restricted collection. All code is straightforward Python using the pymongo library. There is no obfuscation, no concealed executable behavior, no persistence mechanisms, no credential exfiltration, and no unrelated payloads. The script only connects to a user-supplied MongoDB instance, inserts test data, and runs the aggregation pipeline to demonstrate unauthorized data access.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareMongoDB Server
Attack typesImproper Authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to test for the presence of the vulnerability by executing a crafted aggregation pipeline and checking the response for an authorization error. It does not contain payloads to exfiltrate data, establish persistence, or perform any post-exploitation actions. The README describes it as a tool to 'test it on your own'.

CVE-2025-6713.py:55-68README.md:21-23

Requirements

  • A MongoDB instance with a user that has read access to a public collection but not to a restricted collection.CVE-2025-6713.py:6-12README.md:39-47
  • The pymongo Python library must be installed.requirements.txt:1

Observed behavior

  • Connects to a MongoDB instance using provided credentials.CVE-2025-6713.py:34
  • Drops and recreates two collections, inserting test data into each.CVE-2025-6713.py:14-26
  • Executes an aggregation pipeline on the accessible collection that uses $mergeCursors to reference the restricted collection.CVE-2025-6713.py:39-56
  • Prints the results of the aggregation and checks for an authorization error to report whether the PoC succeeded or failed.CVE-2025-6713.py:58-68
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
mongodb://localhost:27017The script connects to a MongoDB instance specified by the user. This is expected for a PoC that demonstrates a MongoDB vulnerability.CVE-2025-6713.py:6
Vulnerability Demonstration
Aggregation pipeline using $mergeCursors to access restricted collectionThe core of the PoC is an aggregation pipeline that uses the $mergeCursors stage to merge data from a restricted collection into an accessible one, demonstrating the CVE.CVE-2025-6713.py:39-56
Review boundaries

What the analysis did not establish

  • One file (4 total, 3 with content) was omitted from the evidence, so the analysis may be incomplete.
  • The evidence does not include the execution output of the script, so its effectiveness cannot be verified.
  • One file (unclassified, 1060 bytes) was not included as text and was analyzed via metadata only. Its content could not be reviewed, but the inventory reports no binary files and the selected text coverage is complete for the provided readable files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2