A flaw in the updateUser command allows an authenticated user to alter authentication‑related information of another user account, potentially changing how that account authenticates. The vulnerability can lead to unauthorized configuration changes that may compromise account security, though it does not directly enable remote code execution or full privilege escalation.

MongoDB Server is impacted. No specific version information is disclosed, so all deployed instances of MongoDB Server fall under this advisory.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a low probability of exploitation based on publicly available data. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the system; the flaw is exploitable only by users with legitimate access to the updateUser command. Since the risk involves partial control over authentication data, the threat level is moderate and primarily relevant to environments where user isolation and strict privilege separation are not enforced.