CVE-2026-87109 [MEDIUM] – An authenticated Ops Manager organization member can retrieve another member’s pending aut

An authenticated Ops Manager organization member can retrieve another member’s pending authenticator enrollment seed through user-listing endpoints while that member’s enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.