CVE-2026-103265

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.89.0

Description An authorization failure occurs in the 'commands/results' endpoint where MDM command results are not properly filtered by team authorization. This allows team-scoped users to access MDM command results for hosts belonging to other teams when a shared command UUID targets hosts across multiple teams. This exposure includes host UUIDs, command payloads, and device responses.

Recommendations Update Fleet to version 4.89.0 or later.