An authenticated user can supply the $search and $searchMeta aggregation stages in a sharded topology and bypass per-user access controls because the server performs insufficient input validation. This flaw allows the client to influence internal routing that is normally supplied by a trusted router, leaking data from collections that the user should not see. The weakness is a classic input validation error (CWE-20). The potential impact is the unauthorized disclosure of data that may contain sensitive or confidential information.

MongoDB Server in a sharded deployment is impacted. No specific affected versions are listed in the advisory; administrators should verify which releases contain the fix once it is available.

The CVSS score of 6 indicates a medium severity issue. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have an authenticated session with a user that has the privilege to run aggregation pipelines, a condition that is likely met by many typical database users. The flaw is therefore exploited by providing crafted $search or $searchMeta fields during an aggregation query.