← CVE Intelligence

CVE-2026-87109

Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings PUBLISHED

Description (CNA)

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.

Affected (CNA)

Vendor / productVersions
MongoDB / Ops Manageraffected 7.0.0 through 7.0.23; affected 8.0.0 before 8.0.27

CWE

CWE-201

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.