This vulnerability involves incorrect authorization (CWE-863) in MongoDB Server. Specifically, an authenticated user who has privileges to terminate cursors on one database can terminate active cursors on another database because the authorization check does not properly scope privileges to the correct namespace. This can disrupt ongoing queries for other users. The affected versions explicitly include 7.0, 8.0, 8.2.0, and 8.3.0. The CVSS 4.0 base score is 2.3, indicating low severity. There is no vendor-provided patch or remediation level information available at this time, and no known exploits in the wild have been reported.

An authenticated user with cursor termination privileges on one database can terminate active cursors on a separate database, potentially disrupting query operations for other users. The impact is limited to disruption of ongoing queries and does not indicate privilege escalation or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict cursor termination privileges carefully and monitor for unusual cursor termination activity. No official remediation or temporary fix has been published by the vendor as of now.