CVE-2026-87108

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - cna@mongodb.com

Published

2026-10-09

Last modified

2026-10-15

Weaknesses

CWE-639

Affected products

• Ops Manager (Mongodb)

References

• https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027