{"id":"CVE-2026-87108","published":"2026-10-09T06:17:12.980","lastModified":"2026-10-09T17:16:50.470","description":"An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.","cvssScore":3.1,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}