CVE-2026-41262

Name of the Vulnerable Software and Affected Versions Fleet DM (affected versions not specified)

Description An issue exists in the global policy read endpoint GET /api/latest/fleet/policies/{policy id} where authorization is performed against an empty structure with a nil TeamID. This allows the system to fetch any policy by ID from the database without verifying if the policy belongs to the global scope. Consequently, an authenticated user with observer-level access to any single team can bypass team isolation to read full details of policies belonging to any other team. This includes access to SQL queries, host pass/fail counts, and software installer or script metadata. The flaw is located in the GetPolicyByIDQueries() function, which fails to perform post-fetch team verification.

Recommendations Implement a post-fetch check in the GetPolicyByIDQueries() function to verify that the returned policy is a global policy by ensuring the TeamID is nil. If the TeamID is not nil, the request should be denied. As a temporary mitigation, restrict access to the GET /api/latest/fleet/policies/{policy id} endpoint to only highly trusted administrators.