A high-severity authorization bypass in MongoDB Server allows authenticated attackers to read arbitrary files from the underlying host filesystem, posing a significant risk to data confidentiality.

This is a missing authorization vulnerability (CWE-862) within the MozJS scripting engine. An authenticated attacker can leverage a module loading hook to execute JavaScript calls that read files from the host filesystem with the service account privileges of the mongod process.

The ability for an authenticated user to perform arbitrary file reads can lead to the exposure of highly sensitive information, such as server configuration files, environment variables, and stored credentials. This could facilitate lateral movement within the network or provide the necessary components for a full system compromise. With a CVSS score of 7.7, this vulnerability represents a substantial risk to internal data security.

Immediate Action: Apply the vendor-provided security patches for the affected MongoDB versions immediately to restrict access to the file system via the scripting engine.

Proactive Monitoring: Monitor database query logs for unusual JavaScript execution patterns or attempts to access system-level directories via the database interface.

Compensating Controls: Restrict access to the database to trusted users only and enforce the principle of least privilege for all service accounts to minimize the potential impact of file system access.

Public Exploit Available: Unknown

Database administrators should prioritize the deployment of the security updates provided by MongoDB. Ensuring that only verified users have access to the database engine and applying current patches will mitigate the risk of unauthorized file disclosure and maintain the security of the host environment.