CVE-2026-101047 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests enterprise tier only with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet...

CVE-2026-101047

Fleet versions before 4.87.0 are vulnerable to an unauthenticated download of in-house iOS application packages and manifests. The root cause is the failure to implement intended random, time-limited URL tokens for specific endpoints required by Apple's InstallEnterpriseApplication MDM command. A...

ipatool

ipatool is a command line tool that allows you to search for iOS, iPadOS, tvOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages. Requirements A supported operating system macOS, Linux, Windows or iOS. An Apple Account already configured to use the App Store...