Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-18690

Опубликовано: 11 авг. 2026
Источник: nvd
CVSS3: 8.1
EPSS Низкий

Описание

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Версия от 7.0.0 (включая) до 7.0.40 (исключая)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Версия от 8.0.0 (включая) до 8.0.29 (исключая)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Версия от 8.2.0 (включая) до 8.2.12 (включая)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Версия от 8.3.0 (включая) до 8.3.8 (исключая)
cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*
cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*
cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*

EPSS

Процентиль: 17%
0.00253
Низкий

8.1 High

CVSS3

Дефекты

CWE-863

Связанные уязвимости

CVSS3: 8.1
ubuntu
около 1 месяца назад

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

CVSS3: 8.1
debian
около 1 месяца назад

An issue in MongoDB Server could allow an authenticated user with a li ...

CVSS3: 8.1
github
около 1 месяца назад

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

EPSS

Процентиль: 17%
0.00253
Низкий

8.1 High

CVSS3

Дефекты

CWE-863