CVE-2026-18712
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
MongoDB Server has an issue in Queryable Encryption maintenance operations that could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
Risk Assessment
An authenticated user can compromise data integrity in other collections, potentially leading to data corruption or loss.
Recommendation
Apply patches provided by MongoDB or restrict user privileges to the minimum necessary.
Original NVD description (English source)
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.