CVE-2025-11575CWE-276

CVE-2025-11575

High · published October 23, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

⚡ A gaping hole in default permissions could lead to privilege escalation in MongoDB Atlas SQL ODBC driver versions 1.0.0 to 2.0.0! Think of it like a VIP lounge at a concert where the bouncer mistakenly lets in anyone with a general ticket — suddenly, everyone can access the backstage pass! 🎤 If exploited, this vulnerability could allow unauthorized users to gain elevated privileges, potentially leading to data tampering, unauthorized access to sensitive information, or full control over the database environment. It’s an opportunity for attackers to walk in and do almost anything they want—absolutely devastating!

Put simply

Think of it like a VIP lounge at a concert where the bouncer mistakenly lets in anyone with a general ticket — suddenly, everyone can access the backstage pass! 🎤 This vulnerability arises from incorrect default permissions set in the MongoDB Atlas SQL ODBC driver, allowing users to escalate their privileges beyond intended limits without proper authentication checks.

What to do

If exploited, this vulnerability could allow unauthorized users to gain elevated privileges, potentially leading to data tampering, unauthorized access to sensitive information, or full control over the database environment. It’s an opportunity for attackers to walk in and do almost anything they want—absolutely devastating! To safeguard your systems, update the MongoDB Atlas SQL ODBC driver to version 2.0.1 or later immediately. Additionally, review your permission settings to ensure they align with your security policies. You've got this! Stay vigilant and proactive, and you'll keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00134 · 2.6th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-10-23T05:15Z
References (1)
EPSS history
Timeline
  • 23 OCT 00:22Z
    MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories
    cvelistv5