GHSA-Q9C5-PP7M-FM2G: Missing Authorization in Fleet Enterprise iOS Application Distribution Endpoints
Vulnerability ID: GHSA-Q9C5-PP7M-FM2G
CVSS Score: 5.3
Published: 2026-08-20
A missing authorization vulnerability in Fleet device management software allows unauthenticated remote attackers to access proprietary enterprise iOS packages (.ipa) and manifest configurations by scanning predictable integer identifiers.
TL;DR
Missing access control checks on legacy iOS application endpoints in Fleet Enterprise allow unauthenticated remote attackers to retrieve and download proprietary corporate applications via integer enumeration.
Technical Details
- CWE ID: CWE-862
- Attack Vector: Network (AV:N)
- CVSS Score: 5.3
- EPSS Score: N/A
- Impact: Information Disclosure (Proprietary Application Leaks)
- Exploit Status: None
- CISA KEV Status: Not Listed
Affected Systems
- Fleet (Enterprise tier only)
-
Fleet Enterprise: < 4.87.0 (Fixed in:
4.87.0)
Mitigation Strategies
- Upgrade Fleet to version 4.87.0 or above
- Implement network-level access controls to restrict public exposure of the Fleet API
- Audit and remove legacy internal iOS applications from the Fleet software catalog
Remediation Steps:
- Verify the current version of Fleet by running 'fleet --version' or checking the administrator dashboard.
- Back up the Fleet backend database.
- Deploy the updated Fleet v4.87.0 container image or binary.
- Verify that the database migrations complete successfully.
- Confirm that attempts to access the manifest endpoint without a valid token result in an authorization error.
References
Read the full report for GHSA-Q9C5-PP7M-FM2G on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)