CVE-2026-18698: Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18698?
The severity of CVE-2026-18698 is medium, rated at 5.4.
How do I fix CVE-2026-18698?
To mitigate CVE-2026-18698, ensure that users have appropriate roles and privileges that restrict access to protected system collections.
What causes CVE-2026-18698?
CVE-2026-18698 is caused by improper authorization that allows authenticated users with limited roles to access protected system collections.
Which software is affected by CVE-2026-18698?
CVE-2026-18698 affects MongoDB Server, specifically various deployments of the database.
What actions can authenticated users perform due to CVE-2026-18698?
Due to CVE-2026-18698, authenticated users can perform unauthorized actions on system collections using the validate command.