CVE-2026-18704

Katalog CVE

CVSS 6.5 · Medium EPSS 0,20%

Kerentanan Missing Authorization pada mongodb. Skor CVSS 3.1 6.5 (Medium) menurut mongodb.com.

Deskripsi (NVD)

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/SERVER-129936 advisory vendor · issue tracking