This vulnerability (CVE-2026-6915) in MongoDB Server arises from improper validation of specified quantity in input (CWE-1284) within the user management command. It allows an authenticated user with limited privileges to modify certain authentication-related data of other user accounts, which could impact authentication behavior. The CVSS 4.0 base score is 5.3 (medium severity), indicating a network attack vector with low complexity and no user interaction required. Affected versions include 7.0.0, 8.0.0, and 8.2.0. No patch or vendor advisory detailing remediation is currently available.

An authenticated user could alter authentication-related data for other user accounts, potentially changing how authentication is performed for those accounts. This may lead to unauthorized changes in authentication behavior but does not directly imply full account takeover or privilege escalation beyond the described scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor MongoDB user management activities closely and restrict authenticated user privileges to the minimum necessary. Avoid granting unnecessary permissions that could allow modification of other users' authentication data.