GHSA-q9c5-pp7m-fm2g: Fleet Unauthenticated Download Of In-house IOS Vulnerability

MODERATE
Share
CVSS 5.3
CWE-862
Published
Advisory Summary

GHSA-q9c5-pp7m-fm2g is a MODERATE (CVSS 5.3) unauthenticated download of in-house ios vulnerability (CWE-862: Missing Authorization) affecting Fleet libraries in the Go ecosystem. The issue involves unauthenticated download of in-house ios app binaries via predictable urls. Remediation is available by upgrading affected packages to version 4.87.0.

GHSA-q9c5-pp7m-fm2g at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-q9c5-pp7m-fm2g
Severity MODERATE
CVSS v3.1 Base Score 5.3
CWE Classification CWE-862: Missing Authorization
Affected Product Fleet
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 5.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix GHSA-q9c5-pp7m-fm2g

To remediate this vulnerability, upgrade all affected Fleet dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/fleetdm/fleet/v4 fixed: 4.87.0 
Upgrade github.com/fleetdm/fleet/v4 to 4.87.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/fleetdm/fleet/v4

How to Check if You Are Affected

To determine whether your application is affected by GHSA-q9c5-pp7m-fm2g, inspect your project dependencies for Fleet:

inspect dependencies for github.com/fleetdm/fleet/v4

Analyze the terminal output to locate any version of Fleet in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.87.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-862: Missing Authorization, where the product does not perform an authorization check when an actor attempts to access a resource or perform an action. In Fleet, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers. ### Impact By design, Apple's `InstallEnterpriseApplication` MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place. The result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns `fleet.ErrMissingLicense`. There is no privilege escalation, write access, or impact on hosts not managed by Fleet. ### Workarounds If an immediate upgrade is not possible: - Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments. - Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel. - Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs. ### For more information If you have any questions or comments about this advisory: Email us at [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits We thank @offset for responsibly reporting this issue.

GHSA-q9c5-pp7m-fm2g Affected Fleet Versions

1 component(s)
Fixed Versions:
4.87.0
Product / Package Ecosystem Affected Versions Fixed Version
github.com/fleetdm/fleet/v4
golang/github.com/fleetdm/fleet/v4
Go
< 4.87.0
4.87.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g
Fleet Source Repository REPOSITORY
https://github.com/fleetdm/fleet
Fleet Release RELEASE
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0

Frequently Asked Questions

What is GHSA-q9c5-pp7m-fm2g?
GHSA-q9c5-pp7m-fm2g is a security vulnerability in Fleet involving Unauthenticated download of in-house iOS app binaries via predictable URLs under CWE-862: Missing Authorization.
Which Fleet versions are affected?
Affected versions include releases prior to 4.87.0 across affected packages: github.com/fleetdm/fleet/v4.
What version fixes GHSA-q9c5-pp7m-fm2g?
Upgrading to 4.87.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/fleetdm/fleet/v4 affected?
Yes, github.com/fleetdm/fleet/v4 is affected in releases prior to 4.87.0. Upgrade your dependency to 4.87.0 or later.
What is the CVSS score of GHSA-q9c5-pp7m-fm2g?
GHSA-q9c5-pp7m-fm2g has a CVSS v3.1 base score of 5.3 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with GHSA-q9c5-pp7m-fm2g?
GHSA-q9c5-pp7m-fm2g is classified under CWE-862: Missing Authorization (The product does not perform an authorization check when an actor attempts to access a resource or perform an action.).
How can I check Go dependencies for GHSA-q9c5-pp7m-fm2g?
Run the dependency tree command: 'inspect dependencies for github.com/fleetdm/fleet/v4'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q9c5-pp7m-fm2g",
  "modified" : "2026-08-20T18:44:31Z",
  "published" : "2026-08-20T18:44:31Z",
  "aliases" : [ ],
  "summary" : "Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs",
  "details" : "### Summary\n\nTwo endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.\n\n### Impact\n\nBy design, Apple's `InstallEnterpriseApplication` MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.\n\nThe result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns `fleet.ErrMissingLicense`. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.\n\n### Workarounds\n\nIf an immediate upgrade is not possible:\n\n- Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments.\n- Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel.\n- Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @offset for responsibly reporting this issue.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/fleetdm/fleet/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.87.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fleetdm/fleet"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-20T18:44:31Z",
    "nvd_published_at" : null
  }
}