Why is MongoDB user with the only privilege as "find" able to insert and update collection?
according to https://docs.mongodb.com/manual/reference/built-in-roles/
the &quot;readwrite&quot; is to blame ...

readWrite
Provides all the privileges of the read role plus ability to modify data on all non-system collections and the system.js collection.
The role provides the following actions on those collections:


collStats
convertToCapped
createCollection
dbHash
dbStats
dropCollection
createIndex
dropIndex
find
insert
killCursors
listIndexes
listCollections
remove
renameCollectionSameDB
update

Although the list also contains the remove - right .