An authenticated attacker with direct network access to a MongoDB shard can illicitly commit or abort an in‑progress prepared transaction by exploiting an authorization flaw. This allows the attacker to deviate from the normal transaction coordination path and create cross‑shard data inconsistencies, corrupt the cluster clock, and undermine the atomicity guarantees that MongoDB provides. The weakness is a missing authorization check (CWE‑862).

The vulnerability affects MongoDB Server. No specific version information is provided in the CNA notice, so all deployments that may contain the flaw should be assessed for the presence of the transaction coordination code path described.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user who already has network access to a shard; no additional privileges or remote code execution are required. Once exploited, the attacker can cause data inconsistencies and claim lost atomicity, potentially leading to integrity violations across multiple shards.