CVE-2026-18704

HIGH

Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-18704 has a selected CVSS score of 7.1 (high).

Description

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MongoDB Server

Browse MongoDB / MongoDB Server

Default status: unaffected

CVE List8.3.0 to < 8.3.8affected

References

2