CVE-2026-18696
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An authenticated user with specific non-default privileges can perform data-definition operations, such as dropping or modifying collections, on collections they do not have permission to manipulate, due to an inconsistency in target collection determination between authorization check and actual operation.
Risk Assessment
The vulnerability can lead to unauthorized modification or deletion of data, compromising data integrity and potentially causing application disruptions.
Recommendation
It is recommended to update MongoDB to a patched version and review user privileges to ensure they do not have excessive DDL permissions.
Original NVD description (English source)
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.