Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-18690

Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.3.0 to < 8.3.8affected
  • 8.0 to < 8.0.29affected
  • 7.0 to < 7.0.40affected

References