An authenticated user with a read‑only project role in MongoDB Ops Manager can retrieve a daily host monitoring record that belongs to a different project when the user knows the record identifier. The flaw is an improper authorization issue (CWE‑639) that allows the disclosure of deployment metadata, such as host information and configuration details. The information exposed could be useful to an attacker for mapping or further compromising the infrastructure, but it does not enable code execution or privilege escalation beyond the read view.

The vulnerability applies to all installations of MongoDB Ops Manager where a read‑only role is assigned to a user and where host monitoring records are queried. Because no specific product version is listed in the CNA data, the issue could affect any current or older releases until a patch is provided by the vendor.

The CVSS base score is 2.3, indicating low severity. No EPSS information is available and the flaw is not listed in CISA’s KEV catalog, suggesting limited exploitation. The attack requires an authenticated user with the correct role and knowledge of the record identifier; no additional network or privilege escalation steps are needed. Overall, the risk remains low, but monitoring or patching is recommended.