{"uuid": "5c7ac8f3-75ea-4f7a-956f-13ae3769ba37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-q9c5-pp7m-fm2g", "type": "seen", "source": "https://gist.github.com/alon710/0122b45acaabf4bffe85ea5b5b868155", "content": "# GHSA-Q9C5-PP7M-FM2G: GHSA-Q9C5-PP7M-FM2G: Missing Authorization in Fleet Enterprise iOS Application Distribution Endpoints\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-Q9C5-PP7M-FM2G\n\n## Summary\nA missing authorization vulnerability in Fleet device management software allows unauthenticated remote attackers to access proprietary enterprise iOS packages (.ipa) and manifest configurations by scanning predictable integer identifiers.\n\n## TL;DR\nMissing access control checks on legacy iOS application endpoints in Fleet Enterprise allow unauthenticated remote attackers to retrieve and download proprietary corporate applications via integer enumeration.\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3\n- **EPSS Score**: N/A\n- **Impact**: Information Disclosure (Proprietary Application Leaks)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Fleet (Enterprise tier only)\n- **Fleet Enterprise**: < 4.87.0 (Fixed in: `4.87.0`)\n\n## Mitigation\n\n- Upgrade Fleet to version 4.87.0 or above\n- Implement network-level access controls to restrict public exposure of the Fleet API\n- Audit and remove legacy internal iOS applications from the Fleet software catalog\n\n**Remediation Steps:**\n1. Verify the current version of Fleet by running 'fleet --version' or checking the administrator dashboard.\n2. Back up the Fleet backend database.\n3. Deploy the updated Fleet v4.87.0 container image or binary.\n4. Verify that the database migrations complete successfully.\n5. Confirm that attempts to access the manifest endpoint without a valid token result in an authorization error.\n\n## References\n\n- [GitHub Security Advisory Record](https://github.com/advisories/GHSA-q9c5-pp7m-fm2g)\n- [Fleet DM Security Advisory](https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g)\n- [Fleet v4.87.0 Release Notes](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-Q9C5-PP7M-FM2G) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T18:31:25.879242Z"}