An authenticated user with low privileges can read and modify data that should be protected by role‑based query‑level access controls. The flaw arises from insufficient validation of certain client‑supplied command parameters used by the find, update, delete, and aggregate operations. This allows a privilege bypass (CWE‑807) and results in unauthorized data exposure and alteration.

MongoDB Server is affected. Specific versions are not listed in the data, but the issue applies to deployments running in non‑apiStrict configuration.

The vulnerability has a CVSS score of 8.6, indicating high severity. The EPSS score is less than 1 % and the flaw is not listed in CISA’s KEV catalog, suggesting that exploitation is not widely reported yet but could occur. Attackers must first authenticate with a low‑privilege account; once authenticated, they can send specially crafted commands to bypass role‑based controls and perform unauthorized reads or writes.