The vulnerability in cve-search's POST /fetch_cve_data endpoint allows unauthenticated attackers to control parameters that specify the MongoDB collection, projected fields, and regex filters. This improper input validation (CWE-20) leads to unauthorized reading of arbitrary MongoDB collections, including the mgmt_users collection containing administrative credentials. The flaw can result in exposure of sensitive data and compromise of administrative accounts through offline password cracking.

Attackers can remotely access sensitive database collections without authentication, exposing administrative usernames and password hashes. This can lead to offline password cracking and potential administrative account takeover, posing a critical security risk to the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity. Avoid exposing the service to untrusted networks.