low3.1
CVE-2026-87108
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they posse…
Impact
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Ops Manager | from 7.0.0 before 7.0.23 from 8.0.0 before 8.0.27 |