7.1

CVE-2026-18705

Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
MongoDB ≫ MongoDB Version >= 7.0.0 < 7.0.40
MongoDB ≫ MongoDB Version >= 8.0.0 < 8.0.29
MongoDB ≫ MongoDB Version >= 8.2.0 <= 8.2.12
MongoDB ≫ MongoDB Version >= 8.3.0 < 8.3.8
MongoDB ≫ MongoDB Version 9.0.0 Update alpha0 SwEdition - SwPlatform -
MongoDB ≫ MongoDB Version 9.0.0 Update alpha1 SwEdition - SwPlatform -
MongoDB ≫ MongoDB Version 9.1.0 Update alpha0 SwEdition - SwPlatform -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.191
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
MongoDb 7.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MongoDb 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-807 Reliance on Untrusted Inputs in a Security Decision

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

https://jira.mongodb.org/browse/SERVER-129618
Vendor Advisory
Issue Tracking