This vulnerability arises from improper input validation (CWE-20) in MongoDB Server's Atlas Search feature within sharded cluster environments. Specifically, the $search and $searchMeta aggregation stages rely on internal routing information that should only be populated by trusted components. However, an authenticated user can directly supply these internal routing fields, bypassing intended per-user access controls. This flaw affects versions 8.0, 8.2.0, and 8.3.0 of MongoDB Server. The CVSS 4.0 base score is 6.0, indicating a medium severity issue. No official remediation or patch information is currently available, and no known exploits are reported in the wild.

An authenticated user can bypass per-user access controls in MongoDB Server's Atlas Search on sharded topologies, potentially gaining unauthorized access to data that should be restricted. This compromises the integrity of access control mechanisms but requires authentication and does not allow privilege escalation beyond that user’s authenticated level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for unusual usage of $search and $searchMeta aggregation stages in sharded environments. Avoid exposing MongoDB Server to untrusted networks where possible.