The comment in checkAuthForRenameCollectionCommands (https://github.com/mongodb/mongo/blob/r3.5.9/src/mongo/db/commands/rename_collection_common.cpp?utf8=%E2%9C%93#L63-L66) says that "if you have renameCollectionSameDB and either can read both of source and dest collections or can't read either of source or dest collection", you can do the rename. However, this doesn't match the behavior in line 82. After talking with Spencer Brody and Spencer Jackson, it seems the code is correct, but the comment is not.