The vulnerability exists because the aggregation stage sanitizer misclassifies nested arrays when encountering unrecognized stage keys (e.g., the undocumented MongoDB-internal $_internalInhibitOptimization). This causes the sanitizer to skip stage-level stripping for sibling stages, allowing injection of forbidden operators like $lookup within $facet sub-pipelines. Consequently, a non-admin user with DBViewer read permission can perform unauthorized cross-collection joins, accessing restricted collections and sensitive data such as password-reset tokens (prid), which can lead to account takeover.

The flaw enables unauthorized read access to sensitive data by bypassing intended authorization controls. Specifically, it allows non-admin users with DBViewer read permission to perform cross-collection joins into restricted collections, exposing sensitive information including password-reset tokens. This can facilitate account takeover attacks. The vulnerability does not impact system integrity or availability but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict DBViewer read permissions to trusted users only and monitor for suspicious use of aggregation queries. Avoid exposing the vulnerable aggregation endpoint to untrusted users.