This vulnerability involves a missing authorization check in the MongoDB Server's MozJS scripting engine. The engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the permissions of the mongod process. An attacker with authentication can exploit this by crafting aggregation pipeline commands that leverage this hook to read sensitive files accessible to the server process. The vulnerability is tracked as CWE-862 (Missing Authorization). The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, and low privileges required. No patch or official remediation level has been disclosed as of the publication date.

An authenticated user can read arbitrary files on the host filesystem with the privileges of the MongoDB server process. This could lead to disclosure of sensitive data stored on the server host that the mongod process can access. There is no indication of privilege escalation or remote unauthenticated exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user permissions to the minimum necessary and monitor for unusual aggregation pipeline commands that could exploit this vulnerability.