CVE-2026-87109: CWE-201: Exposure of Sensitive Information Through Sent Data in MongoDB Ops Manager

This vulnerability (CVE-2026-87109) in MongoDB Ops Manager involves an information exposure flaw (CWE-201) where an authenticated member of an Ops Manager organization can retrieve the pending authenticator enrollment seed of another member via user-listing endpoints while the target member's enrollment is still unconfirmed. The disclosed data is sensitive authentication material, potentially compromising the security of multi-factor authentication enrollment processes within the same organization or project.

The impact is the unauthorized disclosure of secret authentication material (pending authenticator enrollment seeds) to other authenticated members within the same organization or project. This could undermine the security of the authentication process by exposing sensitive data that should remain confidential until enrollment confirmation.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider limiting access to user-listing endpoints or restrict membership permissions to trusted users to reduce exposure risk.