{"id":"GHSA-q9c5-pp7m-fm2g","aliases":[],"url":"https://o3.security/vulnerability/GHSA-q9c5-pp7m-fm2g","summary":"Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs","details":"### Summary\n\nTwo endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.\n\n### Impact\n\nBy design, Apple's `InstallEnterpriseApplication` MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.\n\nThe result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns `fleet.ErrMissingLicense`. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.\n\n### Workarounds\n\nIf an immediate upgrade is not possible:\n\n- Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments.\n- Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel.\n- Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @offset for responsibly reporting this issue.","published":"2026-08-20T18:44:31Z","modified":"2026-08-20T19:00:07.409979368Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/fleetdm/fleet/v4","fixedVersion":"4.87.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g"},{"type":"PACKAGE","url":"https://github.com/fleetdm/fleet"},{"type":"WEB","url":"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T19:00:07.409979368Z"}}