MongoDB Server allows an authenticated user with insert privileges to craft a command containing specially constructed encryption parameters. This causes the server to redirect internal metadata writes that are performed with elevated privileges to a target collection different from the one specified by the user, thereby bypassing the original authorization checks. The result is unauthorized modifications to Queryable Encryption metadata, which can corrupt encrypted indexes and affect compaction processes. The weakness is a missing authorization check (CWE-862).

The vulnerability affects MongoDB Server. No specific version information is provided in the public data, so any deployed instance of MongoDB Server where this feature is enabled could be at risk.

The CVSS score is 2.3, indicating a low severity rating. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently a high exploitation risk. However, exploitation requires an authenticated user with insert privileges and the ability to construct a command with encryption parameters. A malicious actor could use this to modify metadata of other encrypted collections, potentially causing integrity issues and service disruptions. The attack vector is internal and relies on valid credentials, so exposure is limited to users who can connect to the database.