CVE-2026-18712

Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

CVE-2026-18712 is fixed in MongoDB on 1 platform by MongoDB 8.3.11 (version 8.3.11), released September 9, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.2
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0024
14th percentile

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

Where it's fixed

ProductFixed inFixReleased
Windows apps
MongoDB 8.3.11 MongoDB 8.3.11 Sep 9, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.