The vulnerability occurs when schema validation is enabled on a MongoDB collection and an attempted update or insert violates the schema. In this scenario, the server logs a message containing the offending data. The logged message may retain unredacted user information, potentially exposing sensitive data to anyone with access to the logs. This constitutes a data leakage issue classified as CWE-532.

MongoDB Server versions before 7.0.34, before 8.0.23, before 8.2.9 and before 8.3.2 are affected and need to be upgraded.

The CVSS score is 4.8, reflecting a moderate risk. EPSS is not available and the vulnerability is not in the CISA KEV catalog. The likely attack vector is an application or administrator that can submit documents that violate the schema; the attacker can then read the unredacted logs via local log access. Because the issue is contained to local log files, remote exploitation is unlikely, but any breach of the logs could expose sensitive data.