MongoDB aggregation injection — $facet allowlist bypass → cross-collection read

When it applies

• An API runs a user-controlled aggregation pipeline on a fixed collection (db.collection('x').aggregate(userPipeline)), usually exposed as a pipeline query/body parameter for "advanced" search.
• The server defends with a stage allowlist — only screens the top-level stage names ($match/$project/$sort/$limit/$facet allowed; $lookup/$unionWith/$group/… rejected with something like "invalid or disallowed pipeline stage").
• Tell-tale that a pipeline param even exists: sending the normal search term as a Mongo operator object (?q[$ne]=x) returns a hint such as "Operator-form queries not accepted on 'q'. Use the 'pipeline' parameter…".