CVE-2026-101047: Missing Authorization in fleetdm fleet
Fleet versions before 4.87.0 have a missing authorization vulnerability in two endpoints that serve in-house iOS application packages and manifests for the enterprise tier. These endpoints do not enforce the intended random, time-limited URL token, allowing unauthenticated attackers with network access to download IPA binaries and metadata by guessing sequential title identifiers. The vulnerability only allows read-only disclosure and does not affect privilege escalation or write access. The free tier is not affected.
AI Analysis
Technical Summary
Fleet before version 4.87.0 fails to protect two endpoints that deliver in-house iOS application packages and manifests with the required random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be accessible without a Fleet session, session-based authentication cannot be used. This missing token protection allows an unauthenticated attacker with network access to the Fleet server to enumerate and download IPA binaries and their metadata by guessing sequential title identifiers. The vulnerability is limited to read-only information disclosure and does not provide privilege escalation or write capabilities. The free tier is unaffected as it returns an error indicating a missing license.
Potential Impact
An unauthenticated attacker with network access to the Fleet server can download in-house iOS application binaries and metadata, potentially exposing sensitive application information. However, the impact is limited to read-only disclosure with no privilege escalation or ability to modify data. The free tier of Fleet is not affected by this vulnerability.
Mitigation Recommendations
A fix is available in Fleet version 4.87.0. Users should upgrade to version 4.87.0 or later to ensure the endpoints serving in-house iOS application packages and manifests are properly protected with the intended random, time-limited URL token. Until upgraded, users should be aware of the risk of unauthorized read access to these endpoints in the enterprise tier.
CVE-2026-101047: Missing Authorization in fleetdm fleet
Description
Fleet versions before 4.87.0 have a missing authorization vulnerability in two endpoints that serve in-house iOS application packages and manifests for the enterprise tier. These endpoints do not enforce the intended random, time-limited URL token, allowing unauthenticated attackers with network access to download IPA binaries and metadata by guessing sequential title identifiers. The vulnerability only allows read-only disclosure and does not affect privilege escalation or write access. The free tier is not affected.
CVSS v4.0
Score 6.9medium
Affected software
fleetdm
fleet
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Fleet before version 4.87.0 fails to protect two endpoints that deliver in-house iOS application packages and manifests with the required random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be accessible without a Fleet session, session-based authentication cannot be used. This missing token protection allows an unauthenticated attacker with network access to the Fleet server to enumerate and download IPA binaries and their metadata by guessing sequential title identifiers. The vulnerability is limited to read-only information disclosure and does not provide privilege escalation or write capabilities. The free tier is unaffected as it returns an error indicating a missing license.
Potential Impact
An unauthenticated attacker with network access to the Fleet server can download in-house iOS application binaries and metadata, potentially exposing sensitive application information. However, the impact is limited to read-only disclosure with no privilege escalation or ability to modify data. The free tier of Fleet is not affected by this vulnerability.
Mitigation Recommendations
A fix is available in Fleet version 4.87.0. Users should upgrade to version 4.87.0 or later to ensure the endpoints serving in-house iOS application packages and manifests are properly protected with the intended random, time-limited URL token. Until upgraded, users should be aware of the risk of unauthorized read access to these endpoints in the enterprise tier.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-27T15:48:49.472Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab9c994f7a7c54106f51d57
Added to database: 09/28/2026, 01:57:40 UTC
Last enriched: 09/28/2026, 01:58:49 UTC
Last updated: 09/28/2026, 02:07:45 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.