$graphLookup $_internalFromPipeline should be included in privilege checks

ExportXMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 9.0.7
    • Affects Version/s: None
    • Component/s: None
    • None
    • DB Integration & Observability
    • Fully Compatible
    • ALL
    • v9.0
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Both this ticket and SERVER-136876 are needed to abuse the security issue described in SERVER-136876. We should probably fix both of them. See the repro steps in SERVER-136876 an example

            Assignee:
            Finley Lau
            Reporter:
            Henri Nikku
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: