Critical Alert: MongoDB Compass

Updates or deletions using MongoDB Compass may occur on a different document than expected under certain specific conditions

We have identified a bug in MongoDB Compass where modification or deletion of a document through Compass may occur on a different document than expected under certain specific conditions. See the “Impact” section below for more information.

MongoDB Compass versions from 1.3 up to and including 1.11.1 (stable release) are affected, as well as beta versions up to and including 1.12.0-beta.4.

Compass 1.11.2 (stable release) includes a fix for this issue and is available for download on the MongoDB download center and through the automatic update feature built into Compass. All MongoDB Compass users running affected versions should upgrade immediately to avoid this issue.

Impact

We have identified a bug where modification or deletion of a document may occur on a different document than expected when documents with identical _id’s exist in different collections. Corruption or loss of a user’s own data is possible due to this collision.

Users are affected by this issue if:

  • they are running Compass version 1.3.x and higher, and
  • they have documents with identical _id’s in two (or more) collections within the same database and
  • they viewed and updated or deleted these documents in the same Compass session

Patches

Compass 1.11.2 (stable release) includes a fix for this issue and is available for download on the MongoDB download center, and through the automatic update feature built into Compass.

Workarounds

There are no workarounds for this issue. All users running the affected version should upgrade to make sure they're not impacted.