STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

DISA Rule

SV-265936r1028813_rule

Vulnerability Number

V-265936

Group Title

SRG-APP-000340-DB-000304

Rule Version

MD7X-00-006800

Severity

CAT II

CCI(s)

• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Ensure users are assigned only to authorized roles.

To revoke a role from a user in a database, run the following commands:

> use <database>
> db.revokeRolesFromUser( "<username>", [ <roles> ], { <writeConcern> } )

https://www.mongodb.com/docs/v7.0/reference/method/db.revokeRolesFromUser/

Check Contents

A organizational or site-specific document should exist and be reviewed to determine what built-in MongoDB roles and associated privileges may be considered authorized and what users are administrative users.

For each database, run the following commands in MongoDB as an administrative user to determine what users and roles they are assigned:

> use <database>
> db.getUsers()

For any nonadministrative user in a database, check if any roles are not compliant with the site-specific documentation for users.

If any nonadministrative user in a database has a noncompliant role, this is a finding.

Vulnerability Number

V-265936

Documentable

False

Rule Version

MD7X-00-006800

Severity Override Guidance

A organizational or site-specific document should exist and be reviewed to determine what built-in MongoDB roles and associated privileges may be considered authorized and what users are administrative users.

For each database, run the following commands in MongoDB as an administrative user to determine what users and roles they are assigned:

> use <database>
> db.getUsers()

For any nonadministrative user in a database, check if any roles are not compliant with the site-specific documentation for users.

If any nonadministrative user in a database has a noncompliant role, this is a finding.

Check Content Reference

M

Target Key

5637