CVE-2026-18705: Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18705?
The severity of CVE-2026-18705 is rated as medium, with a score of 6.5.
How do I fix CVE-2026-18705?
To fix CVE-2026-18705, ensure proper authorization checks are implemented for all user-supplied fields in MongoDB Atlas Vector Search.
What type of vulnerability is CVE-2026-18705?
CVE-2026-18705 is classified as an improper authorization vulnerability.
Who is affected by CVE-2026-18705?
Authenticated users with read access to one view in MongoDB Atlas Vector Search may be affected by CVE-2026-18705 as they can access protected view data.
What is the impact of CVE-2026-18705?
The impact of CVE-2026-18705 is unauthorized access to protected view data, potentially compromising data confidentiality.