# CVE-2026-18696: Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections

> CVE-2026-18696: Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-18696
Last updated: 2026-10-23T21:10:00Z

- Published: 2026-08-11 18:40 UTC · Updated: 2026-10-23 21:10 UTC · Assigner: mongodb
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- EPSS: 0.40%, 34th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-863

## Description

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-18696)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-18696)
- [https://jira.mongodb.org/browse/SERVER-130139](https://jira.mongodb.org/browse/SERVER-130139)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-18696 · Markdown: https://rewindex.com/cve/CVE-2026-18696.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-18696 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:50.541Z