CVE-2026-18696

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-186977.5An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexCVE-2026-186985.4An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected systCVE-2026-186996.5An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to termiCVE-2026-18705.3The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data dCVE-2026-187006.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference toCVE-2026-187016.5An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminateCVE-2026-187026.4An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certCVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations aCVE-2026-187056.5An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documentCVE-2026-187066.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-managemenCVE-2026-187074.3An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to term
CVE-2026-18696: Medium severity, CVSS 6.5 | Vulnix