Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

MongoDB Server lets certain users drop collections without permission

CVE-2026-18696 · published 2 months ago
Summary

MongoDB Server’s applyOps feature can be tricked by users who have some but not all rights, allowing them to delete or change database tables they shouldn’t touch. This could let a compromised account modify or erase important data. Review user privileges and restrict or disable the applyOps command until a fix is applied.

What to do
  • Update mongodb to version 8.3.8.
  • Update mongodb to version 9.0.2.
  • Update mongodb mongodb server to version 8.3.8 or later.
Affected software
Ecosystem VendorProductAffected versions
– mongodb mongodb server < 8.3.8
– mongodb mongodb >= 7.0.0, < 7.0.40
>= 8.0.0, < 8.0.29
>= 8.2.0, <= 8.2.12
>= 8.3.0, < 8.3.8
9.0.0
9.1.0
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
Bitnami – mongodb >= 8.2.0, < 8.3.8
>= 9.0.0, < 9.0.2
Fix: upgrade to 8.3.8
Original advisory text
Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Sources
CVE-2026-18696 · NVD
CVE-2026-18696 · MITRE
BIT-mongodb-2026-18696 · OSV
CVE-2026-18696 · OSV
Track software like this
Free during beta