CVE-2026-18698

MediumCVSS 5.4/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
MongoDBMongoDB Server>= 8.3.0, < 8.3.8; >= 8.0, < 8.0.29; >= 7.0, < 7.0.40

References

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-186996.5An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to termiCVE-2026-18705.3The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data dCVE-2026-187006.5An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference toCVE-2026-187016.5An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminateCVE-2026-187026.4An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certCVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations aCVE-2026-187056.5An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documentCVE-2026-187066.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-managemenCVE-2026-187074.3An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to termCVE-2026-187086.4An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control CVE-2026-187096.4An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progr
CVE-2026-18698: Medium severity, CVSS 5.4 | Vulnix