Vulnerability · Published Aug 11, 2026 · Assigned by mongodb
CVE-2026-18702Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
Medium 6.4
In plain English
A medium-severity privilege mismanagement in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 – before 8.3.88.0 – before 8.0.297.0 – before 7.0.40 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L