Threats tagged 'ghsa-gm7f-v959-fr2g'

Fleet versions prior to 4.85.0 have a vulnerability in the global policy read endpoint that allows authenticated users with observer-level access on any team to read policy details from other teams. This occurs because the endpoint does not verify team ownership and returns policy data without proper scope checks. The flaw allows enumeration of policy IDs to access sensitive policy SQL queries and related metadata across team boundaries. The issue is fixed in version 4.85.0.