medium5.3
CVE-2026-87109
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that …
Impact
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Ops Manager | from 7.0.0 before 7.0.23 from 8.0.0 before 8.0.27 |