PT-2026-103798
CVE-2026-103265
·
Published
2026-10-01
·
Updated
2026-10-01
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Fleet versions prior to 4.89.0
Description
An authorization failure occurs in the 'commands/results' endpoint where MDM command results are not properly filtered by team authorization. This allows team-scoped users to access MDM command results for hosts belonging to other teams when a shared command UUID targets hosts across multiple teams. This exposure includes host UUIDs, command payloads, and device responses.
Recommendations
Update Fleet to version 4.89.0 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾