← Vulnerability feed

Vulnerability record · CVE-2020-7927 · published 23 November 2020

CVE-2020-7927: Mongodb ops manager vulnerability

Mongodb · Ops Manager

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

6.5 CVSS 3.1 Medium EPSS 1.0% · top 37.3% CWE-648 · CWE-648
6.5CVSS 3.1 base score, v2 4.0
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3

Track CVE-2020-7927 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-8431Mongodb ops manager command injection vulnerabilityAn administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specif…EPSS 0.71%5.3CVE-2019-2388Mongodb ops manager vulnerabilityIn affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops …EPSS 1.00%4.6CVE-2021-20335Mongodb ops manager cleartext transmission vulnerabilityFor MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB proces…EPSS 0.14%10.0CVE-2026-76460Cisco ISE API authentication bypass via insufficient access controlCisco Identity Services Engine contains an authentication bypass in an API endpoint caused by insufficient authentication control. An unauthenticated…KEVEPSS 14%analysed5.4CVE-2026-20122Cisco Catalyst SD-WAN Manager API arbitrary file overwriteThe API interface of Cisco Catalyst SD-WAN Manager mishandles uploaded files, letting an authenticated remote attacker overwrite arbitrary files on t…KEVEPSS 25%analysed

Source: NIST National Vulnerability Database (record CVE-2020-7927), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.