The vulnerability allows an authenticated user whose permissions are limited to a single database to change diagnostic logging settings that apply across the entire MongoDB server. This can suppress logs that would normally reveal malicious activity or flood logs with unnecessary data, degrading operational visibility. The weakness is an improper authorization issue, CWE‑269, that permits a scope bypass. The impact is a loss of audit trail integrity and potential concealment of attacker actions, not a direct data breach or service outage but a significant covert execution allowance.

MongoDB Server installations are affected. No specific version range is listed, so all current builds that support the profile command and do not contain the patch are vulnerable. Users should verify if their deployment includes the fix, which is not detailed here.

The CVSS score of 5.3 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates a very low yet non‑zero probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. Likely attack vectors require the user to be authenticated and have database‑level access—an attacker with such credentials can issue the profile command to alter global settings. The vulnerability is local in that it does not require remote network access; however, the compromised diagnostics can be leveraged to facilitate larger covert attacks.