This vulnerability in MongoDB Server arises from an internal-use aggregation stage being reachable by external clients without adequate authorization checks. As a result, authenticated users with read-only privileges can exploit this flaw to perform write operations on collections they should not modify. The issue is classified under CWE-862 (Missing Authorization). No affected versions or patch information are provided in the available data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required (low), no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with valid read-only credentials can escalate their privileges to perform unauthorized write operations on MongoDB collections. This compromises data integrity by allowing modification of data without proper authorization. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor MongoDB vendor advisories for updates. Until a fix is available, consider restricting access to trusted users and environments to limit exposure.