This vulnerability in MongoDB Server permits an authenticated user with restricted database-scoped roles to access and act on protected system collections without the necessary elevated privileges. The flaw could expose collection metadata and potentially allow unauthorized changes to system collection data depending on the deployment setup. The issue relates to improper access control (CWE-863). No specific affected versions or patches are provided in the available data. There are no known exploits in the wild and the product is not a cloud service, so remediation responsibility lies with the user.

An attacker with limited database-scoped privileges can gain access to metadata of protected system collections and, in certain configurations, modify system collection data without authorization. This could compromise data integrity and confidentiality within the MongoDB environment. The impact does not include denial of service or availability loss. The CVSS score of 5.4 reflects a moderate impact on confidentiality and integrity with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor MongoDB vendor advisories for updates. Until a fix is available, review and restrict database-scoped roles to minimize exposure and avoid deployment configurations that could allow unauthorized system collection modifications.