CVE-2026-118510
A type-handling flaw in the relationship query building of this MongoDB integration library can…
- Risk score
- 53/100
- CVSS
- 8.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with ba…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
Last activity 28 Oct 2026. Patch Forecast updates every hour.