title: Authorization session conflation
description: After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22.
Workaround:
After deleting one or more users, restart any nodes which may have had active user authorization sessions.
Refrain from creating user accounts with the same name as previously deleted accounts.
problem types: CWE-285 Improper Authorization
affected:
{
defaultStatus: unaffected
product: MongoDB Server
vendor: MongoDB Inc.
versions:
lessThan: 4.0.9, status: affected, version: 4.0, versionType: custom
lessThan: 3.6.13, status: affected, version: 3.6, versionType: custom
lessThan: 3.4.22, status: affected, version: 3.4, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: After deleting one or more users, restart any nodes which may have had active user authorization sessions.