An authenticated user with read permissions on one view can retrieve documents from another protected view that shares the same underlying collection. The flaw arises because MongoDB Server’s Atlas Vector Search does not properly validate user‑supplied fields when building the internal request to the search process. This improper authorization vulnerability allows data leakage from views that the user should not see, damaging confidentiality.

MongoDB Server implementations that enable Atlas Vector Search are affected. No specific version information is listed in the CNA data, so all deployments of MongoDB Server that use Vector Search should verify whether they include the fix by consulting the vendor’s release notes.

The CVSS score of 7.1 denotes a high impact, yet the EPSS score of less than 1% indicates a low probability of exploitation in the wild at present. The vulnerability is not listed in CISA KEV. Attackers must have valid database credentials with at least read access to a susceptible view and must invoke the vector search API. The exploit therefore requires authenticated access and the vector search operation to be carried out from within the database environment. Overall, the risk exists but is constrained to users who already possess some level of authorization.