The flaw, identified as CWE-863, allows an authenticated user with only limited read rights to view documents in collections that the user should not be able to access. It arises because the $graphLookup aggregation stage is evaluated inconsistently during authorization checks and during actual execution, which creates a gap that can be exploited through view pipelines that reference other collections.

MongoDB Server installations that use $graphLookup within view pipeline definitions. Any deployment where a view includes the $graphLookup stage on a collection the authenticated user normally cannot read is susceptible; the CVE does not list specific version numbers, so all versions that expose this functionality are potentially affected.

The CVSS score of 7.1 indicates high severity. The EPSS score of < 1% suggests that widespread automated exploitation is unlikely, but the vulnerability does not appear in the CISA KEV catalog. Because an attacker only needs legitimate authentication with restricted read privileges, the risk to confidentiality for users who can be granted read access is significant, especially in environments with many read‑only users or poorly defined collection permissions.