CVE-2026-18690: Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections

Published Aug 11, 2026

Updated

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

Affected Software

1 affected component

MongoDB MongoDB Server

Event History

Aug 11, 2026

CVE Published

via MITRE·06:47 PM

Data Sourced

via MITRE·06:47 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-18690?

CVE-2026-18690 has a severity rating of 8.1, classified as high.

How do I fix CVE-2026-18690?

To fix CVE-2026-18690, ensure that your MongoDB Server is updated to the latest patched version that addresses this improper authorization issue.

What systems are affected by CVE-2026-18690?

CVE-2026-18690 affects the MongoDB Server where users can have limited database-scoped roles.

What actions can be performed due to CVE-2026-18690?

CVE-2026-18690 allows authenticated users with limited roles to perform unauthorized actions on protected system collections.

What are the potential consequences of CVE-2026-18690?

The potential consequences of CVE-2026-18690 include the dropping and recreation of critical system collections without proper authorization.