CVE-2026-87108: Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ops Manager deployments are exposed where authenticated users have a read-only project role and can obtain identifiers for daily host monitoring records belonging to other projects. The issue affects cross-project access to deployment metadata.
What does an attacker need to exploit it?
An attacker needs an authenticated Ops Manager account with a read-only project role and the required identifier for a daily host monitoring record in another project. Exploitation is rated high complexity.
What information could be disclosed?
The exposed daily host monitoring record may reveal deployment metadata, including host and configuration details. The provided assessment indicates low confidentiality impact and no integrity or availability impact.