This vulnerability arises from insufficient validation of certain user-supplied fields when constructing internal requests forwarded to the search process in MongoDB Server's Atlas Vector Search feature. An authenticated user with read permissions on one view can exploit this flaw to retrieve documents from a different, protected view over the same underlying collection. The vulnerability is identified as CWE-807, indicating reliance on untrusted inputs in a security decision. It affects MongoDB Server versions 7.0, 8.0, and 8.3.0. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low complexity, no privileges required beyond read access, no user interaction, and high impact on confidentiality.

An attacker with read access to one view can access sensitive documents from another protected view within the same collection, potentially leading to unauthorized data disclosure. The vulnerability does not allow privilege escalation or integrity/availability impact but compromises confidentiality significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict read access to views carefully and monitor for unusual access patterns involving Atlas Vector Search. Follow MongoDB's official advisories for updates.