CVE-2026-18696: Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18696?
The severity of CVE-2026-18696 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-18696?
To fix CVE-2026-18696, ensure that users are granted only the necessary privileges to avoid unauthorized DDL operations.
What type of operations are affected by CVE-2026-18696?
CVE-2026-18696 affects data-definition operations such as dropping or modifying collections.
Who is affected by CVE-2026-18696?
CVE-2026-18696 affects authenticated users with specific non-default privileges in MongoDB.
What can an attacker do with CVE-2026-18696?
An attacker can perform unauthorized DDL operations on collections they do not have permission to manipulate.