The vulnerability is a type handling flaw in the whereDoesntHave query method of the Laravel MongoDB integration library. Because numeric string identifiers are incorrectly cast, the resulting query incorrectly allows records that should be excluded. A user with ordinary privileges can therefore view, modify, or delete documents that the access control logic was intended to protect. This can lead to confidentiality, integrity, and availability breaches of application data.

All versions of the MongoDB integration library for Laravel, prior to the 5.12.0 release, are affected. The issue is present in applications that use the whereDoesntHave method to enforce record visibility constraints. The library is distributed under the name MongoDB:Laravel MongoDB.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, but the bug can be exploited silently without error output, making detection difficult. Since it is not listed in CISA KEV, there is no confirmed exploitation yet, but the vulnerability is suitable for privilege escalation attacks that require no privileged access. The most likely attack path is via a web application endpoint that uses whereDoesntHave; a basic authenticated user can supply numeric string IDs to bypass the restriction.