MongoDB Database Tools mongorestore versions 100.4.0 through before 100.20.1 inconsistently handle the system.buckets. prefix when validating collection names in untrusted dumps. This flaw allows a specially crafted collection name to bypass special-collection guards and namespace filters, potentially enabling the creation of unauthorized user accounts, including those with root privileges, during a restore operation. Exploitation requires operator action with sufficient user-management privileges and cannot be prevented by excluding the admin namespace alone.