Executive brief
Fleet is a mobile device management (MDM) platform used by enterprises to deploy and manage iOS applications on company-owned devices. Two endpoints that serve in-house iOS app packages lack proper authentication controls, allowing an attacker with network access to the Fleet server to download proprietary application binaries and metadata. While the leaked data is read-only, this could expose sensitive business applications or intellectual property. The vulnerability is limited to enterprise-tier deployments only.
Technical details
This vulnerability is a missing authorization flaw (CWE-862) in Fleet's in-house iOS application serving endpoints. The endpoints are designed to be network-reachable by managed iOS devices (as required by Apple's InstallEnterpriseApplication MDM command) but lack the random, hard-to-guess token pattern implemented in Fleet's legacy MDM installer path. An unauthenticated attacker with network access to the Fleet server can enumerate in-house app identifiers sequentially and download IPA binaries along with metadata (bundle ID, version, name) without authentication. The attack requires network reachability to the Fleet server and succeeds without user interaction or prior privileges. A patch is available in Fleet v4.87.0 which implements time-limited token validation for these endpoints.
Affected products
- Fleet Fleet < 4.87.0
Timeline
- 2026-08-11: disclosed
- 2026-08-20: patched: Patch released in Fleet v4.87.0