This vulnerability in MongoDB Server's Queryable Encryption maintenance operations allows an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data in a different collection. The root cause is insufficient validation of internal metadata references before they are used to perform operations on other namespaces, leading to incorrect authorization (CWE-863). The CVSS 4.0 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The affected versions explicitly include 7.0, 8.0, and 8.3.0.

An attacker with authenticated access and privileges on one encrypted collection can manipulate or destroy data in other collections without proper authorization. This could lead to data integrity loss and unauthorized data modification within the database environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor MongoDB's official advisories for updates and apply patches promptly once available.