CVE-2026-25963: Fleet Authorization Bypass Vulnerability

MODERATE
Advisory Identifier: GHSA-5jvp-m9h4-253h
Share
CWE-863
Published
Advisory Summary

CVE-2026-25963 is a MODERATE authorization bypass vulnerability (CWE-863: Incorrect Authorization) affecting Fleet libraries in the Go ecosystem. The issue involves authorization bypass in certificate template batch deletion for team administrators. Remediation is available by upgrading affected packages to version 4.80.1.

CVE-2026-25963 at a Glance

CVE Identifier CVE-2026-25963
GHSA Identifier GHSA-5jvp-m9h4-253h
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-863: Incorrect Authorization
Affected Product Fleet
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2026-25963

To remediate this vulnerability, upgrade all affected Fleet dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/fleetdm/fleet/v4 fixed: 4.80.1 
Upgrade github.com/fleetdm/fleet/v4 to 4.80.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/fleetdm/fleet/v4

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-25963, inspect your project dependencies for Fleet:

inspect dependencies for github.com/fleetdm/fleet/v4

Analyze the terminal output to locate any version of Fleet in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.80.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Fleet, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary A broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. ### Impact Fleet supports certificate templates that are scoped to individual teams. In affected versions, the batch deletion endpoint validated authorization using a user-supplied team identifier but did not verify that the certificate template IDs being deleted actually belonged to that team. As a result, a team administrator could delete certificate templates associated with other teams, potentially disrupting certificate-based workflows such as device enrollment, Wi-Fi authentication, VPN access, or other certificate-dependent configurations for the affected teams. This issue does not allow privilege escalation, access to sensitive data, or compromise of Fleet’s control plane. Impact is limited to integrity and availability of certificate templates across teams. ### Patches - v4.80.1 ### Workarounds If an immediate upgrade is not possible, administrators should restrict access to certificate template management to trusted users and avoid delegating team administrator permissions where not strictly required. ### For more information If there are any questions or comments about this advisory: Email Fleet at [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits Fleet thanks @secfox-ai for responsibly reporting this issue.

CVE-2026-25963 Affected Fleet Versions

1 component(s)
Fixed Versions:
4.80.1
Product / Package Ecosystem Affected Versions Fixed Version
github.com/fleetdm/fleet/v4
golang/github.com/fleetdm/fleet/v4
Go
< 4.80.1
4.80.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/fleetdm/fleet/security/advisories/GHSA-5jvp-m9h4-253h
NVD — CVE-2026-25963 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25963
Security Fix Commit FIX COMMIT
https://github.com/fleetdm/fleet/commit/d27d0362db390fe835e3b5328525f25018df0fb7
Fleet Source Repository REPOSITORY
https://github.com/fleetdm/fleet

Frequently Asked Questions

What is CVE-2026-25963?
CVE-2026-25963 is a security vulnerability in Fleet involving Authorization Bypass in certificate template batch deletion for team administrators under CWE-863: Incorrect Authorization.
Which Fleet versions are affected?
Affected versions include releases prior to 4.80.1 across affected packages: github.com/fleetdm/fleet/v4.
What version fixes CVE-2026-25963?
Upgrading to 4.80.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/fleetdm/fleet/v4 affected?
Yes, github.com/fleetdm/fleet/v4 is affected in releases prior to 4.80.1. Upgrade your dependency to 4.80.1 or later.
What CWE is associated with CVE-2026-25963?
CVE-2026-25963 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check Go dependencies for CVE-2026-25963?
Run the dependency tree command: 'inspect dependencies for github.com/fleetdm/fleet/v4'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5jvp-m9h4-253h",
  "modified" : "2026-02-26T19:40:10Z",
  "published" : "2026-02-26T19:40:10Z",
  "aliases" : [ "CVE-2026-25963" ],
  "summary" : "Fleet: Authorization Bypass in certificate template batch deletion for team administrators",
  "details" : "### Summary\n\nA broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance.\n\n### Impact\n\nFleet supports certificate templates that are scoped to individual teams. In affected versions, the batch deletion endpoint validated authorization using a user-supplied team identifier but did not verify that the certificate template IDs being deleted actually belonged to that team.\n\nAs a result, a team administrator could delete certificate templates associated with other teams, potentially disrupting certificate-based workflows such as device enrollment, Wi-Fi authentication, VPN access, or other certificate-dependent configurations for the affected teams.\n\nThis issue does not allow privilege escalation, access to sensitive data, or compromise of Fleet’s control plane. Impact is limited to integrity and availability of certificate templates across teams.\n\n### Patches\n\n- v4.80.1\n\n### Workarounds\n\nIf an immediate upgrade is not possible, administrators should restrict access to certificate template management to trusted users and avoid delegating team administrator permissions where not strictly required.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\nEmail Fleet at [security@fleetdm.com](mailto:security@fleetdm.com)  \nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nFleet thanks @secfox-ai for responsibly reporting this issue.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/fleetdm/fleet/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.80.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fleetdm/fleet/security/advisories/GHSA-5jvp-m9h4-253h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25963"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fleetdm/fleet/commit/d27d0362db390fe835e3b5328525f25018df0fb7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fleetdm/fleet"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-26T19:40:10Z",
    "nvd_published_at" : "2026-02-26T03:16:04Z"
  }
}