Yüksek CVSS 8.1
CVE-2026-18690: Mongodb: hatalı yetkilendirme
Açıklama (NVD)
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.
Özet bilgiler
- Ürün
- Mongodb Mongodb
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - CVSS v4.0
- 7.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS
- %0,41 (yüzdelik 35)
- CWE
- CWE-863
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| mongodb-mongodb | 7.0.0 | — | 7.0.40 |
| mongodb-mongodb | 8.0.0 | — | 8.0.29 |
| mongodb-mongodb | 8.2.0 | 8.2.12 | — |
| mongodb-mongodb | 8.3.0 | — | 8.3.8 |
| mongodb-mongodb | 9.0.0 | 9.0.0 | — |
| mongodb-mongodb | 9.0.0 | 9.0.0 | — |
| mongodb-mongodb | 9.1.0 | 9.1.0 | — |