An authenticated user with a limited database‑scoped role can invoke the validate command on protected system collections. The command normally requires higher privileges, but due to missing authorization checks the attacker can retrieve metadata about the system collections and, depending on deployment settings, alter their data. This can lead to disclosure of internal catalog information and unauthorized modification of system‑level data, compromising database integrity.

All installations of MongoDB Server may be vulnerable; no specific edition or version range is listed, so any deployment should be reviewed until a vendor fix is available.

The CVSS score of 5.3 places the issue in the medium severity range, and the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be authenticated with a role that grants limited database‑scoped permissions and then run the validate command against a system collection. The flaw relies on a missing privilege check, making the exploitation path an authenticated privilege escalation that grants read or write access to system‑level data.