This vulnerability in MongoDB Server's aggregation framework allows an authenticated user with only read privileges to bypass authorization controls and perform write operations on collections they should not modify. The root cause is a missing authorization check on an internal-use aggregation stage that is reachable by external clients, violating the intended access control model.

An attacker with read-only access can escalate privileges to perform write operations on database collections, potentially leading to unauthorized data modification. This breaks the principle of least privilege and can compromise data integrity within affected MongoDB deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Until a patch is available, restrict access to trusted users and monitor for suspicious activity related to aggregation framework usage.