Hey Guys

I have been observing some strange permissions related behaviour in mongodb.

1. use db01
2. create user01 with dbOwner role on db01
3. login as user01
4. db.testData.insert({"state": 1})
5. use db02
6. create user02 with dbOwner role on db02
7. login as user02
8. use db01
9. show collections

What you should see:

• error you do not have permissions to access db01

What you actually see:

• user02 seems to be able to list the tables / collections on db01 without any issues