Threats tagged 'ghsa-x4qr-qw6h-wvxq'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.4%	CVE-2026-46371Fleet · Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint Medium6.5EPSS 0.4%2026-06-26GCVE DatabaseCVE-2026-46371 A vulnerability in Fleet versions up to 4.84.1 allows an authenticated user with Observer-level privileges to extract sensitive enrollment secrets and Apple Push Notification Service tokens via an unvalidated order_key parameter in the Apple MDM commands endpoint. This flaw enables a sort-order oracle attack that leaks sensitive data character-by-character without exposing it directly in responses. The issue is fixed in version 4.84.2. EPSS 0.4%Report on CVE-2026-46371 Vulnerability CWE-200 #ghsa-x4qr-qw6h-wvxq #go	GCVE Database	2026-06-26

Page 1 of 1