The CVE describes an authorization bypass in the Countly Server DBViewer component. A flaw in the aggregation stage sanitizer allows an authenticated user with read permissions, but not admin rights, to inject disallowed MongoDB operators such as $lookup into $facet sub‑pipelines. The sanitizer misclassifies nested arrays as generic arrays when an element contains an unrecognized key, skipping proper sanitization for all sibling stages. By manipulating this behavior, the attacker can perform cross‑collection joins into protected collections, read sensitive data like password‑reset tokens, and potentially compromise user accounts. This flaw is identified as a CWE‑863 vulnerability that permits privilege escalation or privilege bypass during request handling.

All installations of Countly Server that contain the DBViewer feature are affected. The advisory does not delimit a specific version range, so any current or future release that incorporates the relevant code path is potentially vulnerable. Administrators should audit their installations to confirm whether the DBViewer component is enabled and whether the affected code path is present.

The CVSS score of 7.1 represents a medium‑to‑high risk. EPSS is not available, so the likelihood of widespread exploitation remains unknown, and the vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires an authenticated non‑admin account with DBViewer read access; once the injection is successful, the attacker can read restricted collections and gain account‑takeover leverage. Given the potential impact on confidentiality and account integrity, affected deployments should address the issue promptly, even in the absence of current exploitation evidence.