This vulnerability arises from a discrepancy in how the $graphLookup aggregation stage is processed for authorization checks compared to its execution phase. As a result, users with limited read privileges might bypass intended access controls and retrieve documents from unauthorized collections. The problem manifests in contexts where collections are referenced inside view pipeline definitions. The vulnerability is classified under CWE-863 (Incorrect Authorization). No affected versions or patch information are explicitly stated.

An authenticated user with limited read privileges could gain unauthorized read access to documents from collections they should not be able to access. This represents a breach of access control and confidentiality. There is no indication of privilege escalation beyond read access or impact on integrity or availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting use of $graphLookup in view pipeline definitions or limiting access to affected features if possible.