This vulnerability (CVE-2026-18690) in MongoDB Server involves incorrect authorization (CWE-863) that permits an authenticated user with limited database-scoped privileges to perform actions on protected system collections beyond their assigned permissions. Specifically, the flaw allows dropping and recreating critical system collections without proper authorization. The CVSS 4.0 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability. The affected versions explicitly include 7.0, 8.0, and 8.3.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with authenticated access and limited database-scoped roles can exploit this vulnerability to drop and recreate critical system collections, which may lead to data loss, corruption, or disruption of database operations. The integrity and availability of the MongoDB Server could be significantly impacted if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, restrict authenticated user privileges carefully and monitor for suspicious activity related to system collections. Avoid granting unnecessary database-scoped roles that could be leveraged to exploit this vulnerability.