Unauthorized collection reads via divergent graph traversal checks

Incorrect authorization in MongoDB Server allows remote authenticated users with read privileges to access unauthorized collection documents. For a $graphLookup stage stored in a view pipeline, authorization and execution resolve referenced collections inconsistently, so execution traverses collections omitted from the effective authorization check. Reachability requires read access to the view and permission to invoke its pipeline; the consequence is disclosure of documents from otherwise unreadable collections, with no reported write or service-interruption capability.