CVE-2026-103265
mediumFleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint.
Vendor / product: Fleetdm — fleet
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
CVSS
4.3
4.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-10-01 11:17
Modified: 2026-10-08 13:17
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:56 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
fleetdm / fleet <4.89.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/fleetdm/fleet/security/advisories/GHSA-97fg-h5wh-2399 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/fleet-before-4.89.0-information-disclosure-via-mdm-co... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗