This vulnerability (CVE-2026-72657) in Elastic Fleet Server involves an authorization bypass (CWE-639) where the artifact download authorization depends on a user-controlled key. The server persists a client-supplied value without validating it against the server-side record of the requesting agent's assigned policies. Consequently, an authenticated party with valid enrolled agent credentials can retrieve policies that the agent is not authorized to access, leading to potential information disclosure. The issue is categorized under CWE-639 and relates to manipulation of user-controlled variables (CAPEC-77).

An authenticated agent can bypass authorization controls to access policy information not assigned to it, resulting in unauthorized information disclosure. There is no indication of integrity or availability impact. The vulnerability requires low attack complexity and privileges of an enrolled agent, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a fix is available, restrict access to enrolled agent credentials and monitor for unusual access patterns consistent with unauthorized policy retrieval.