CVE-2026-87108: CWE-639: Authorization Bypass Through User-Controlled Key in MongoDB Ops Manager

This vulnerability (CVE-2026-87108) in MongoDB Ops Manager allows an authenticated user with read-only access to a project to retrieve daily host monitoring records belonging to other projects if they know the record identifier. The root cause is insufficient validation of ownership for these records, leading to unauthorized access to deployment metadata including host and configuration details. The issue affects versions >=7.0.0 <=7.0.23 and >=8.0.0 <8.0.27. The CVSS 4.0 vector indicates network attack vector, low complexity, privileges required, no user interaction, and low impact on confidentiality.

An attacker with authenticated read-only project access can access monitoring records from other projects, exposing potentially sensitive deployment metadata such as host and configuration information. The impact is limited to information disclosure and does not affect integrity or availability. The low CVSS score reflects the limited scope and required privileges.

No explicit patch or remediation information is provided in the vendor advisory. Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Until a fix is available, restrict access to Ops Manager to trusted users and monitor for unauthorized access attempts to sensitive records.