Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
BIT-mongodb-2026-18712
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:BIT-mongodb-2026-18712
mongodb
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 7.0.40
Source reference:
/affected/0/ranges8.0.29Source reference:
/affected/0/ranges8.3.8Source reference:
/affected/0/ranges9.0.2Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.40"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.29"
},
{
"introduced": "8.2.0"
},
{
"fixed": "8.3.8"
},
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.2"
}
]
}
],
"package": {
"name": "mongodb",
"purl": "pkg:bitnami/mongodb",
"ecosystem": "Bitnami"
},
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"database_specific": {
"source": "https://github.com/bitnami/vulndb/tree/main/data/mongodb/BIT-mongodb-2026-18712.json"
}
}
]- Related CVEs
- CVE-2026-18712
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #59539 · Revision 1
- Added to Heist Feed
- Publisher date