A SOC analyst is scoring a newly disclosed web application vulnerability using CVSS v3.1. The vulnerability allows an unauthenticated attacker to modify arbitrary records in the backend database, but it does not expose any data to the attacker and does not disrupt the availability of the service. Which base metric should the analyst rate as High for this vulnerability?