A high-severity vulnerability in MongoDB Server permits low-privileged, authenticated users to bypass role-based access controls and modify or view protected data.

The vulnerability is a result of improper input validation (CWE-807) within command parameters, which allows an authenticated user to override security decisions enforced by role-based access controls.

This flaw carries a CVSS score of 8.1, reflecting a high risk of data integrity and confidentiality loss. Successful exploitation allows unauthorized users to manipulate sensitive information or bypass security barriers, potentially leading to unauthorized data exfiltration or critical system configuration changes.

Immediate Action: Update your MongoDB Server instances to the patched versions: 7.0.39, 8.0.28, 8.2.12, or 8.3.7.

Proactive Monitoring: Review database audit logs for unusual command execution patterns or unauthorized attempts to access collections restricted by role-based policies.

Compensating Controls: Strictly enforce the principle of least privilege for all database users to minimize the impact of a low-privileged account compromise.

Public Exploit Available: Unknown

The ability for a low-privileged user to undermine core security boundaries is a significant risk to database integrity. Organizations should prioritize the upgrade to the specified fixed versions to ensure that role-based access controls remain effective against authenticated threats.