CVE-2019-2386

What it actually does

Improper invalidation of authorization sessions after user deletion allows an active authenticated session to persist and be conflated with a newly created account that reuses the deleted username, resulting in unauthorized access under the new account's identity.

Why it matters to the business

Organizations face risk of unauthorized data access or actions if deleted user accounts are recreated with the same names, potentially leading to privilege misuse, data exposure, or compliance violations in environments with frequent user account turnover.

How an attack unfolds

An attacker obtains valid credentials or an active session for a user account; after the account is deleted by an administrator, the attacker maintains the session; a new account is then created reusing the exact same username, causing the lingering session to grant the attacker the new account's privileges without re-authentication.

How to fix it

Upgrade MongoDB Server to version 4.0.9 or later, 3.6.13 or later, or 3.4.22 or later; restart nodes after any user deletions to invalidate sessions; avoid reusing usernames of previously deleted accounts.

How to confirm the fix worked

Verify running MongoDB versions against the fixed releases; test by deleting a user, creating a new user with the same name, and confirming that prior sessions no longer grant access; review authorization session handling in logs after user modifications.

Typical attack path

1. Obtain valid credentials or hijack an active session for a target user account
2. Wait for or trigger deletion of the original user account
3. Create a new account using the identical username of the deleted account
4. Reuse the persistent session to perform actions under the new account's authorization context

How to detect it

Review MongoDB audit and system logs for sequences of user deletion events followed closely by creation of an account with the identical name; look for authentication or authorization events occurring under a username after its deletion but before a new creation.

What your security team should do

• Immediately upgrade all MongoDB instances to the fixed versions listed for each affected release line
• Implement a policy prohibiting reuse of deleted usernames and enforce it via account provisioning processes
• Schedule periodic restarts of nodes following bulk user deletions as a temporary control
• Monitor for any exploit attempts given the public availability of proof-of-concept code