Vulnerability Details CVE-2026-87109
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.8%
CVSS Severity
CVSS v3 Score 5.3
References
Products affected by CVE-2026-87109
-
cpe:2.3:a:mongodb:ops_manager:7.0.0
-
cpe:2.3:a:mongodb:ops_manager:7.0.1
-
cpe:2.3:a:mongodb:ops_manager:7.0.10
-
cpe:2.3:a:mongodb:ops_manager:7.0.11
-
cpe:2.3:a:mongodb:ops_manager:7.0.12
-
cpe:2.3:a:mongodb:ops_manager:7.0.13
-
cpe:2.3:a:mongodb:ops_manager:7.0.14
-
cpe:2.3:a:mongodb:ops_manager:7.0.15
-
cpe:2.3:a:mongodb:ops_manager:7.0.16
-
cpe:2.3:a:mongodb:ops_manager:7.0.17
-
cpe:2.3:a:mongodb:ops_manager:7.0.18
-
cpe:2.3:a:mongodb:ops_manager:7.0.19
-
cpe:2.3:a:mongodb:ops_manager:7.0.2
-
cpe:2.3:a:mongodb:ops_manager:7.0.20
-
cpe:2.3:a:mongodb:ops_manager:7.0.21
-
cpe:2.3:a:mongodb:ops_manager:7.0.22
-
cpe:2.3:a:mongodb:ops_manager:7.0.3
-
cpe:2.3:a:mongodb:ops_manager:7.0.4
-
cpe:2.3:a:mongodb:ops_manager:7.0.5
-
cpe:2.3:a:mongodb:ops_manager:7.0.6
-
cpe:2.3:a:mongodb:ops_manager:7.0.7
-
cpe:2.3:a:mongodb:ops_manager:7.0.8
-
cpe:2.3:a:mongodb:ops_manager:7.0.9