The vulnerability stems from an inconsistency between the collection identified during authorization checks and the collection actually affected by the applyOps command. This discrepancy allows an authenticated user who holds certain non‑default privileges to execute data‑definition operations—such as dropping or altering collections—that they are not explicitly authorized to perform. The effect is that an attacker can modify or delete data structures, undermining the integrity of the database.

MongoDB Server is affected. No specific product versions are listed in the advisory, so all current releases that have not yet been patched remain vulnerable.

The CVSS score of 7 indicates a medium severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is relatively unlikely, and the issue is not currently listed in CISA’s KEV catalog. The likely attack vector is an authenticated user with inadequate privileges; based on the description, it is inferred that the attacker must be able to submit applyOps commands through a client or application that has valid credentials for the database.