Skip to content
fr Sign in
6.5 Medium

CVE-2026-72657 Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via…

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.

Affected products and versions

Product Affected versions Fixed in
Fleet Server 9.5.0 No fix stated
Fleet Server 9.0 9.0.0 → 9.4.4 No fix stated
Fleet Server 8.3 8.3.0 → 8.19.19 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Fleet Server

The 7 CVEs of Fleet Server →
CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via… 3.1 Low CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of… 6.5 Medium CVE-2026-56150 Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via… 6.5 Medium CVE-2024-52975 An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on… 9.0 Critical
Track this CVE