CVE-2026-87109

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cna@mongodb.com

Published

2026-10-09

Last modified

2026-10-15

Weaknesses

CWE-201

Affected products

• Ops Manager (Mongodb)

References

• https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027