CVE-2026-103265

Katalog CVE

CVSS 4.3 · Medium EPSS 0,20%

Kerentanan Incorrect Authorization pada fleetdm fleet. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.

Rincian

Terbit di NVD

1 Oktober 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fleetdm/fleet/security/advisories/GHSA-97fg-h5wh-2399 advisory vendor
• https://www.vulncheck.com/advisories/fleet-before-4.89.0-information-disclosure-via-mdm-command-results advisory pihak ketiga