The high-severity vulnerability is under active exploitation and affects many versions of MongoDB, a nearly ubiquitous open-source database.

The company removed the bucket from the open internet after being contacted by CyberScoop.

The database contains many instances where the same person is referenced by multiple records.

The database did not require visitors to enter a username or password to access the information.