CVE-2026-18705
Full vulnerability record from the local CVENow database.
Description
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-11 19:17:25.207000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-18705",
"sourceIdentifier": "[email protected]",
"published": "2026-08-11T19:17:25.207",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process."
},
{
"lang": "es",
"value": "Un problema en la característica Atlas Vector Search del servidor MongoDB podría permitir a un usuario autenticado con acceso de lectura a una vista recuperar documentos de una vista diferente y protegida sobre la misma colección subyacente. Esto se debe a un manejo insuficiente de ciertos campos proporcionados por el usuario al construir una solicitud interna reenviada al proceso de búsqueda."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MongoDB",
"product": "MongoDB Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.3.0",
"lessThan": "8.3.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.0",
"lessThan": "8.0.29",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0",
"lessThan": "7.0.40",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T20:25:15.782249Z",
"id": "CVE-2026-18705",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-807"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.0.40",
"matchCriteriaId": "F3DB18E4-812C-4E04-802D-5D6B61CE9D1B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndExcluding": "8.0.29",
"matchCriteriaId": "4DC64BC6-1D47-4809-9616-95A7CF59DC37"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.2.0",
"versionEndIncluding": "8.2.12",
"matchCriteriaId": "7BCD6B05-9FD5-4283-A2AC-8B625425597F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.3.0",
"versionEndExcluding": "8.3.8",
"matchCriteriaId": "6EE4503A-F53C-432E-9DDB-F488DD989E8A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*",
"matchCriteriaId": "0FB52026-6C88-4401-84B5-3A070F0906D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*",
"matchCriteriaId": "8D32A105-731C-493E-8CBF-639204CDAC7C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*",
"matchCriteriaId": "D56E512D-83F8-4D51-8690-E92F6A006822"
}
]
}
]
}
],
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-129618",
"source": "[email protected]",
"tags": [
"Vendor Advisory",
"Issue Tracking"
]
}
]
}