Threats tagged 'ghsa-w784-r3v5-58f4'

An authenticated MongoDB Server user with insert privileges on a collection can exploit a flaw in the encryption metadata handling to write unauthorized data into other encrypted collections' metadata within the same database. This occurs because the server's authorization checks only validate the user-facing target collection, while internal writes use elevated privileges based on client-supplied parameters. The vulnerability could corrupt encrypted index states and compaction operations.