What is CVE-2026-18704?

CVE-2026-18704 is a medium-severity vulnerability in Mongodb Server, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-08-11.

How severe is CVE-2026-18704?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Mongodb Server

CVE-2026-18704

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation st…

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Mongodb Server — versions 8.3.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-18704?: CVE-2026-18704 is a medium-severity vulnerability in Mongodb Server, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-08-11.
How severe is CVE-2026-18704?: Medium severity. CVSS v3 base score is 6.5 out of 10.