STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

The role(s)/group(s) used to modify database structure (including but not limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.

DISA Rule

SV-265914r1028528_rule

Vulnerability Number

V-265914

Group Title

SRG-APP-000133-DB-000362

Rule Version

MD7X-00-003000

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Use the following commands to remove unauthorized access to a MongoDB database:

db.revokePrivilegesFromRole()
db.revokeRolesFromUser()

MongoDB commands for role management can be found here:

https://www.mongodb.com/docs/v7.0/reference/method/js-role-management/

Check Contents

Run the following command to get the roles from a MongoDB database.

For each database in MongoDB:

use <database>
db.getRoles(
{
rolesInfo: 1,
showPrivileges:true,
showBuiltinRoles: true
}
)

Run the following command to the roles assigned to users:

use admin
db.system.users.find()

Analyze the output and if any roles or users have unauthorized access, this is a finding. This will vary on an application basis.

Vulnerability Number

V-265914

Documentable

False

Rule Version

MD7X-00-003000

Severity Override Guidance

Run the following command to get the roles from a MongoDB database.

For each database in MongoDB:

use <database>
db.getRoles(
{
rolesInfo: 1,
showPrivileges:true,
showBuiltinRoles: true
}
)

Run the following command to the roles assigned to users:

use admin
db.system.users.find()

Analyze the output and if any roles or users have unauthorized access, this is a finding. This will vary on an application basis.

Check Content Reference

M

Target Key

5637