CVE-2026-87109 MEDIUM 6.0
Published: 2026-10-09 06:17:13 UTC · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Categories: Azure / M365 Databases
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Weakness: CWE-201
Affected products
cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*