Threats tagged 'ghsa-g6cj-j7ww-3j96'

A vulnerability exists where a user with basic read-tier database privileges can exploit a server-side data-change notification feature to access contents of certain restricted internal collections. This occurs because the privilege check only considers the target namespace and ignores the option that allows access to these internal collections. As a result, users can gain unintended read access to data they are normally denied when attempting direct reads.