{
  "cveId": "CVE-2026-18704",
  "url": "https://patchblox.com/security/cve/CVE-2026-18704",
  "summary": "CVE-2026-18704 is fixed in MongoDB on 1 platform by MongoDB 8.3.11 (version 8.3.11), released September 9, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations",
  "description": "An issue in MongoDB Server\u0027s aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.",
  "published": "2026-08-11T19:17:25Z",
  "severity": "",
  "cvss": 7.1,
  "cwe": "CWE-862: Missing Authorization",
  "epss": 0.00287,
  "epssPercentile": 0.21311,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-18704",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "MongoDB",
      "fixedVersion": "8.3.11",
      "fix": "MongoDB 8.3.11",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.server-8.3.11",
      "released": "2026-09-09T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}