Executive brief
MongoDB Server contains a privilege escalation vulnerability in the applyOps command, which is used for database replication and recovery operations. An authenticated user with specific non-default privileges can bypass collection-level permission checks to drop, modify, or drop indexes on collections they do not have authorization to access. This allows attackers to cause data loss or modify database schemas without proper permission.
Technical details
The vulnerability exists in the applyOps command's handling of command operations (op:"c"). During authorization checking, the target namespace is remapped to use a UUID's database while keeping the original collection name from the operation body, then the command is authorized against <UUID-db>.<o-coll>. However, during actual execution, the drop, collMod, and dropIndexes operations resolve their target purely by UUID without validating consistency between the UUID and collection name in the operation body (error code 3318200). An attacker with cluster-level applyOps and useUUID privileges plus drop rights on their own collection can exploit this divergence by crafting a command operation with a victim collection's UUID to perform unauthorized data definition operations. The CRUD branch of applyOps has a consistency check (error 3318200) but the command branch does not. Patches are available in MongoDB versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-08-11: disclosed: CVE-2026-18696 published
- 2026-08-11: patched: Fixes released in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0