An insufficiency in MongoDB Server’s Queryable Encryption maintenance operations enables an authenticated user with privileges on one encrypted collection to modify or destroy data in a separate, unrelated collection. This occurs because internal metadata references are not properly validated before being applied to operations on other namespaces, allowing the attacker to inject requests that target unauthorized collections. The flaw is a classic instance of improper authorization (CWE-863), potentially allowing attackers to alter or delete confidential data without detection.

MongoDB:MongoDB Server is the affected product. Specific version information is not provided in the CNA data, so the vulnerability may exist in any deployed instance of MongoDB Server where Queryable Encryption maintenance operations are enabled and the affected internal logic is present.

The CVSS score of 7.2 indicates serious severity with significant impact on confidentiality and integrity. The EPSS score of < 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user who has been granted privileges on at least one encrypted collection; the attacker can exploit the lack of proper namespace validation to affect another collection within the same database or cluster. Successful exploitation results in unauthorized data modification or destruction without requiring elevated administrative rights.