Incorrect authorization in MongoDB Server - CVE-2026-18696
Published: August 18, 2026
Vulnerability identifier: #VU144140
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18696
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform unauthorized data-definition operations on collections.
The vulnerability exists due to improper authorization in the applyOps command when processing applyOps operations on collections. A remote privileged user can submit a crafted applyOps command to perform unauthorized data-definition operations on collections.
The issue is caused by an inconsistency between the collection used for the authorization check and the collection targeted by the actual operation.
Affected software
MongoDB Server
How to mitigate CVE-2026-18696
Install security update from vendor's website.
MongoDB Server - addressed in versions 7.0.40, 8.0.29, 8.3.8