Insufficient Access Control in MongoDB Server's Atlas Vector Search Feature

CVE-2026-18705

What is CVE-2026-18705?

An access control issue has been identified in MongoDB Server's Atlas Vector Search feature, which could permit authenticated users with read access to certain views to access documents within a different, secured view using the same underlying collection. This vulnerability arises from inadequate processing of specific user-supplied fields when making internal requests to the search system. Potentially exposing sensitive data, this flaw necessitates immediate attention to reinforce user access controls.

References