{"id":"CVE-2026-87109","published":"2026-10-09T06:17:13.140","lastModified":"2026-10-09T18:17:15.087","description":"An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}