Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-87108

Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Ops Manager

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.23affected
  • 8.0.0 to < 8.0.27affected

References