The vulnerability in MongoDB Database Tools allows an attacker to craft a collection name starting with the system.buckets prefix that bypasses the tool's validation of special collection names. This bypass lets the restore command create an arbitrary database account, including one with the root role, when the restoration is performed with user‑management privileges. The attacker can thereby gain elevated privileges on the target deployment.

Affected are the MongoDB Database Tools binary versions from 100.4.0 up to, but not including, 100.20.1. Any deployment using a mongorestore from these releases and restoring a dump that contains a maliciously named collection is at risk. The vulnerability is specific to the MongoDB tools and does not affect the server itself.

The CVSS score of 5.2 places the flaw in the moderate range, and the absence of an EPSS score or KEV listing indicates no public exploitation data yet. However, exploitation requires only that the operator running mongorestore possess the ability to create users, a privilege that many administrators have. The affected functionality is typically invoked remotely or locally via the restoration process, so an attacker with access to perform the restore can elevate privileges without further compromises.