Description
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | Ops Manager | 7.0.0 – ≤ 7.0.23, 8.0.0 – < 8.0.27 | 8.0.27 |