0

I used robo 3t to login to a database and was surprised that I was able to write on the collection despite having a read only role, by adding a document via the GUI or sending commands through Robo 3T.

What could be the problem? On mongosh (mongo shell) I wasnt able to.

tonidoclouddb> db.getRole("test", {showPrivileges:true}) 
{
  role: 'test',
  db: 'tonidoclouddb',
  isBuiltin: false,
  roles: [],
  inheritedRoles: [],
  privileges: [
    {
      resource: {
        db: 'tonidoclouddb',
        collection: 'users'
      },
      actions: [ 'find' ]
    }
  ],
  inheritedPrivileges: [
    {
      resource: {
        db: 'tonidoclouddb',
        collection: 'users'
      },
      actions: [ 'find' ]
    }
  ]
}
{
  _id: 'tonidoclouddb.mynewuser',
  userId: UUID("46bdf5e7-fb0a-4616-a1ee-5fc46fd0f97f"),
  user: 'mynewuser',
  db: 'tonidoclouddb',
  roles: [ { role: 'test', db: 'tonidoclouddb' } ],
  mechanisms: [ 'SCRAM-SHA-1', 'SCRAM-SHA-256' ]
} ```

Robo 3T user login

Robo 3T response

10
  • Hi and welcome to dba.se! Either you have different credentials when you log in using this tool or there's a serious bug in MongoDB (I'm shocked!).
    – Vérace
    Aug 7 at 10:25
  • 1
    Did you enable authentication and did you restart the mongod database? Verify which privileges you actually got by your role with db.getRole() Aug 7 at 15:25
  • tonidoclouddb> db.getRole("test") { role: 'test', db: 'tonidoclouddb', isBuiltin: false, roles: [], inheritedRoles: [] }
    – user56979
    Aug 7 at 19:36
  • tonidoclouddb> db.getRole("test", {showPrivileges:true}) { role: 'test', db: 'tonidoclouddb', isBuiltin: false, roles: [], inheritedRoles: [], privileges: [ { resource: { db: 'tonidoclouddb', collection: 'users' }, actions: [ 'find' ] } ], inheritedPrivileges: [ { resource: { db: 'tonidoclouddb', collection: 'users' }, actions: [ 'find' ] } ] }
    – user56979
    Aug 7 at 19:38
  • Please put additional information to your question (by "Edit") instead as a comment. Aug 8 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.