Low · published October 9, 2026
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
| Product | Versions | Fixed in |
|---|---|---|
| mongodb/ops_manager | ≥ 7.0.0, < 7.0.23 | 7.0.23 |
| mongodb/ops_manager | ≥ 8.0.0, < 8.0.27 | 8.0.27 |