MongoDB Aggregation Pipeline Authorization Bypass in Countly

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-87803 is an authorization bypass vulnerability in Countly Server's DBViewer that exploits flawed validation logic in the aggregation stage sanitizer. The /o/db endpoint accepts user-controlled aggregation JSON and attempts to filter malicious pipelines by checking whether nested arrays contain only recognized MongoDB stage operators. However, by injecting undocumented or unrecognized stage keys, attackers can bypass this validation and execute arbitrary aggregation operations, potentially accessing sensitive database records without proper authorization. This affects organizations running vulnerable Countly instances, particularly those exposing the DBViewer endpoint to untrusted networks. With a CVSS score of 7.1, this vulnerability poses a significant risk to data confidentiality and integrity.

Casky.ai's 283 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this CVE across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners would observe findings aligned with Authorization Bypass detection patterns, including: anomalous aggregation pipeline requests containing unrecognized stage operators, repeated failed authorization checks followed by successful database queries, suspicious use of MongoDB operators like $lookup or $out in user-supplied payloads, and access patterns inconsistent with the user's documented permissions. The platform would flag requests that probe the stage sanitizer's boundaries, help practitioners understand the chain of validation failures, and correlate these indicators with post-exploitation database access patterns—enabling security teams to identify both active exploitation attempts and historical compromise evidence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87803.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-87803

Casky has 283 skills that investigate the attack patterns behind CVE-2026-87803. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn