jira.mongodb.org
https://jira.mongodb.org/browse/SERVER-130481 CVE-2026-18698
MEDIUM
Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command
Record summary
CVE-2026-18698 has a selected CVSS score of 5.3 (medium).
Description
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
MongoDB ServerBrowse MongoDB / MongoDB ServerDefault status: unaffected | CVE List | 8.3.0 to < 8.3.8 | affected |
| 8.0 to < 8.0.29 | affected | ||
| 7.0 to < 7.0.40 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-18698