This vulnerability allows an authenticated MongoDB user, who should only have limited privileges scoped to a specific database, to alter diagnostic logging settings affecting the entire MongoDB server instance. Instead of restricting changes to their own database, the user can suppress or increase logging globally. This could lead to reduced visibility into unauthorized actions or operational issues due to missing or excessive logs. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, no confidentiality impact, limited integrity impact, and limited availability impact.

An attacker with limited database-scoped privileges can suppress or flood diagnostic logs across the entire MongoDB server. This may obscure detection of unauthorized activities or degrade monitoring capabilities, potentially impacting incident response and operational stability. There is no direct confidentiality loss, but integrity and availability impacts are limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges carefully and monitor for unusual changes in diagnostic logging settings. Avoid granting unnecessary database-scoped privileges that could be abused to alter server-wide settings.