Fleet is an open source device management platform used to manage endpoints including Android devices via Mobile Device Management (MDM). In versions prior to 4.80.1, a missing authorization check in the Android MDM Pub/Sub endpoint allows unauthenticated requests to trigger device unenrollment events. Specifically, an attacker can craft and send requests to this endpoint to unenroll targeted Android devices from Fleet management without any authentication or user interaction. The vulnerability is classified under CWE-862 (Missing Authorization). While the attacker cannot gain access to the Fleet server, execute commands on devices, or access device data, the ability to unenroll devices disrupts device management capabilities, potentially impacting organizational control over Android endpoints. The flaw is addressed in Fleet version 4.80.1. If immediate patching is not feasible, disabling Android MDM functionality temporarily prevents exploitation.

The primary impact is disruption of Android device management within organizations using Fleet for endpoint control. Unauthorized unenrollment removes devices from management, potentially leading to unmanaged devices that do not receive security policies, updates, or monitoring. This can increase the risk of device compromise or data leakage indirectly. However, since no direct access to Fleet or device data is gained, and no command execution is possible, the confidentiality and integrity impacts are minimal. Availability impact is limited to loss of management control over affected Android devices. Organizations relying heavily on Fleet for Android MDM may face operational challenges in maintaining device compliance and security posture until the vulnerability is remediated.

Organizations should upgrade Fleet to version 4.80.1 or later as soon as possible to apply the official fix. If immediate upgrading is not possible, temporarily disabling the Android MDM feature in Fleet will prevent exploitation of this vulnerability. Additionally, monitoring network traffic to the Android MDM Pub/Sub endpoint for unusual or unauthorized requests can help detect exploitation attempts. Implementing network-level access controls to restrict access to Fleet management endpoints to trusted sources can further reduce risk. Regular audits of enrolled devices to detect unexpected unenrollments can aid in early detection of exploitation. Finally, educating security teams about this specific vulnerability ensures timely response and remediation.