The vulnerability is an improper authorization flaw in the aggregation framework of MongoDB Server. An authenticated user with only read permissions can invoke a special aggregation stage that was intended for internal use. Because this stage performs write operations on collections, the lack of an additional authorization check allows the attacker to modify data in collections they should not have access to. This unauthorized write capability can alter, delete, or insert records, compromising data integrity and potentially allowing a malicious user to tamper with application state.

Affected systems include all deployments of MongoDB Server. The CNAs list the vendor/product as MongoDB:MongoDB Server. No specific version information is provided, so all versions that contain the aggregation framework are potentially vulnerable until a fix is applied.

The CVSS score of 7.1 indicates a fairly high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at this time. The vulnerability is not in the KEV catalog, so no known widespread exploitation is currently reported. Based on the description, it is inferred that authentication is required and the attack vector is external. An attacker would need valid credentials to a user with read privileges and then construct an aggregation request that includes the problematic stage, thereby gaining write access to otherwise protected collections.