This vulnerability (CWE-862: Missing Authorization) in MongoDB Server permits an authenticated user with network access to a shard to bypass authorization controls related to transaction coordination. Specifically, the user can improperly commit or abort a prepared transaction that is in progress, circumventing the normal transaction coordination mechanisms. This flaw can lead to inconsistent data across shards, corruption of cluster clock state, and breaking the atomicity guarantees of transactions. The issue affects MongoDB Server versions 7.0, 8.0, and 8.3.0. The CVSS 4.0 base score is 5.9, indicating medium severity. As of the published date, no vendor advisory or patch is available, and no known exploits have been reported in the wild.

An attacker with authenticated access and direct network connectivity to a shard can disrupt the transaction coordination process by committing or aborting prepared transactions improperly. This can cause data inconsistencies across shards, cluster clock corruption, and violate the atomicity of transactions, potentially impacting data integrity and cluster stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit authenticated user access to shards and restrict network access to trusted users only to reduce the risk of exploitation.