Executive brief
Fleet DM, a device management platform, contains a vulnerability that allows users assigned to a specific team to view sensitive security policies belonging to other teams. An attacker with basic observer-level access could read internal SQL queries, compliance data, and script metadata that should be restricted to different departments or clients. This flaw undermines the team isolation model used to keep organizational data separate and secure.
Technical details
The vulnerability exists in the `GetPolicyByIDQueries` function within `server/service/global_policies.go`. The endpoint performs an initial authorization check against an empty `fleet.Policy{}` struct (where `TeamID` is nil), which triggers an OPA rule allowing any team member to read global policies. However, the subsequent database fetch retrieves the policy by ID without verifying that the returned object actually belongs to the global scope or the user's authorized team. An attacker with `observer` or higher privileges on any single team can exploit this by sending requests to `GET /api/latest/fleet/policies/{policy_id}` with sequential IDs to enumerate and read sensitive SQL queries, host pass/fail counts, and script metadata across all teams. The issue is addressed in version 4.85.0 by ensuring team-scoped policies cannot be accessed via the global endpoint.
Affected products
- Fleet DM Fleet < 4.85.0
Timeline
- 2026-06-26: advisory
- 2026-06-26: patched