EUVD-2026-56914
GHSA-85cq-4fh4-j8cv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible via MongoDB port with PR:H since exploitation requires specific non-default applyOps privilege; no confidentiality impact as only DDL operations are achievable.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.
AnalysisAI
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MongoDB user with specific non-default privileges - specifically, access to the applyOps command, which is not granted to standard read, readWrite, or typical application-level roles. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC:N/VI:H/VA:H) scores 7.0, reflecting a network-accessible flaw with low attack complexity but a significant constraint: high privileges are required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated MongoDB user holding a custom or built-in role that includes applyOps access - such as a backup operator or DBA with restore privileges - crafts an applyOps payload where the collection namespace presented during the authorization check resolves differently from the collection ultimately operated upon. The user issues the command over the network, bypasses the intended collection-level permission boundary, and drops or truncates a collection they are not authorized to modify, resulting in data loss or service disruption for applications depending on that collection. … |
| Remediation | No specific patched version has been independently confirmed from available data; organizations should monitor the MongoDB Jira ticket SERVER-130139 (https://jira.mongodb.org/browse/SERVER-130139) and MongoDB's official security advisory channels for a confirmed fix release and apply it upon availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployed MongoDB Server versions and assess which are affected by CVE-2026-18696; consult MongoDB's advisory to determine version-specific impact. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today