Description
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
Published: 2026-10-01
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
Title Fleet before 4.89.0 Information Disclosure via MDM Command Results
First Time appeared Fleetdm
Fleetdm fleet
Weaknesses CWE-863
CPEs cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*
Vendors & Products Fleetdm
Fleetdm fleet
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Fleetdm Fleet
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-01T10:42:06.965Z

Reserved: 2026-09-30T10:58:33.573Z

Link: CVE-2026-103265

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-01T11:17:21.577

Modified: 2026-10-01T11:17:21.577

Link: CVE-2026-103265

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses