CVE-2026-18698
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An authenticated user with a limited database-scoped role can perform actions against protected system collections that should require more specific privileges, potentially exposing collection metadata and, in certain configurations, allowing unauthorized modification of system collection data.
Risk Assessment
The risk includes confidentiality breach of metadata and potential unauthorized modification of system data, which could lead to privilege escalation or integrity compromise.
Recommendation
It is recommended to review and adjust user privileges to ensure roles have only necessary permissions, and update MongoDB to a patched version.
Original NVD description (English source)
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.