CVE-2026-18702
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An authenticated user with limited database-scoped privileges can modify diagnostic logging settings affecting the entire server, not just the intended database. This could allow suppression of server-wide diagnostic logging, potentially hiding unauthorized activity or causing excessive log volume that degrades operational monitoring.
Risk Assessment
The risk includes hiding unauthorized activity and degrading monitoring capabilities, making it harder to detect security incidents and maintain operational stability.
Recommendation
It is recommended to restrict user privileges to the minimum necessary and regularly review logging configuration to prevent unauthorized changes to diagnostic settings.
Original NVD description (English source)
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.