CVE-2026-18712

Published: Aug 11, 2026Modified: Sep 25, 2026

7.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

Affected (7)

Products: Mongodb: Mongodb

Mongodb

1 product

Mongodb

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Mongodb Mongodb	7.0.0 ≤ version < 7.0.40
Mongodb Mongodb	8.0.0 ≤ version < 8.0.29
Mongodb Mongodb	8.2.0 ≤ version ≤ 8.2.12
Mongodb Mongodb	8.3.0 ≤ version < 8.3.8
Mongodb Mongodb	Version 9.0.0 alpha0
Mongodb Mongodb	Version 9.0.0 alpha1
Mongodb Mongodb	Version 9.1.0 alpha0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (1)

https://jira.mongodb.org/browse/SERVER-130633

Source: cna@mongodb.com

Vendor AdvisoryIssue TrackingPatch

Timeline

No history available yet.