[ CVE-2026-118510 · Published 28 Oct 2026 ]
Vulnerability in MongoDB Laravel MongoDB
CVSS 8.8
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
[ Fixes ]Fixes and patches
- Security bulletin: MongoDB r5.14.0Vendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-java-driver/releases/tag/r5.14.0, cited by CERT-FR CERTFR-2026-AVI-1430
- Security bulletin: MongoDB dbtools-100.20.0-changelogVendor patch or bulletin · CERT-FR · mongodb.com/docs/database-tools/release-notes/dbtools-100.20.0-changel, cited by CERT-FR CERTFR-2026-AVI-1430
- Security bulletin: MongoDB 5.12.0Vendor patch or bulletin · CERT-FR · github.com/mongodb/laravel-mongodb/releases/tag/5.12.0, cited by CERT-FR CERTFR-2026-AVI-1430
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1430
Multiple vulnerabilities in MongoDB products Translated from French
Multiple vulnerabilities have been discovered in MongoDB products. Some of them allow an attacker to cause a breach of data integrity, SQL injection (SQLi) and a security policy bypass.