CVE-2026-18705

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-807

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 8.3.0, < 8.3.8; >= 8.0, < 8.0.29; >= 7.0, < 7.0.40

References

https://jira.mongodb.org/browse/SERVER-129618Vendor Advisory, Issue Tracking

Timeline

Published: Aug 11, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-187066.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-managemen CVE-2026-187074.3An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to term CVE-2026-187086.4An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control CVE-2026-187096.4An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progr CVE-2026-18716.5TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization CVE-2026-187106.5A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, t CVE-2026-187117.1An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal re CVE-2026-187128.1An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted CVE-2026-187138.8IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a r CVE-2026-187156.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML e CVE-2026-187169.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial CVE-2026-187177.4ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the