CVE-2026-41262

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

CVE-2026-41262

Fleet (open-source device management platform) versions prior to 4.85.0 contain an authorization bypass in the global policy read endpoint. The GetPolicyByIDQueries handler authorizes against an empty policy object with a nil TeamID, which the OPA policy rule permits for any user holding a role o...

GO-2026-5812 Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet

Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet...