{"id":"EUVD-2026-87978","enisaUuid":"950c1029-2dae-3fe0-9481-33e26d5ea96d","description":"Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple\u0027s InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).","datePublished":"Sep 27, 2026, 5:02:35 PM","dateUpdated":"Sep 30, 2026, 2:47:15 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g\nhttps://www.vulncheck.com/advisories/fleet-before-4.87.0-unauthenticated-ios-app-download-via-predictable-urls\n","aliases":"CVE-2026-101047\nGHSA-jqp5-cmc9-xwxg\n","assigner":"VulnCheck","epss":0.24,"enisaIdProduct":[{"id":"3ad6b5b0-3c8e-315d-bf69-4d93f7dcdbfc","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"0 \u003c4.87.0"}],"enisaIdVendor":[{"id":"c95954ef-92f4-3452-b538-7d664aae4714","vendor":{"name":"fleetdm"}}],"enisaIdVulnerability":[{"id":"28eb7f1d-060c-38c6-9bfb-831a6e994e5d","vulnerability":{"id":"GHSA-jqp5-cmc9-xwxg","description":"Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple\u0027s InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).","datePublished":"Sep 27, 2026, 6:30:23 PM","dateUpdated":"Sep 27, 2026, 6:30:23 PM","baseScore":0.0,"references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101047\nhttps://www.vulncheck.com/advisories/fleet-before-4.87.0-unauthenticated-ios-app-download-via-predictable-urls\n","enisa_id":"EUVD-2026-87978\n","aliases":"CVE-2026-101047\nGHSA-jqp5-cmc9-xwxg\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9674fcd1-62a5-3085-a2de-59b21c8957c4","vulnerability":{"id":"CVE-2026-101047","description":"Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple\u0027s InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).","datePublished":"Sep 27, 2026, 5:02:35 PM","dateUpdated":"Sep 30, 2026, 2:47:15 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g\nhttps://www.vulncheck.com/advisories/fleet-before-4.87.0-unauthenticated-ios-app-download-via-predictable-urls\n","enisa_id":"EUVD-2026-87978\n","assigner":"VulnCheck","epss":0.24,"dataProcessed":"Oct 27, 2026, 7:15:10 AM","vulnerabilityProduct":[{"id":"90bbd193-793b-3759-ba3a-f57eb81a6b02","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"0 \u003c4.87.0"}],"vulnerabilityVendor":[{"id":"4f06196b-9cbd-3368-9169-1abbe9c699ee","vendor":{"name":"fleetdm"}}]}}],"enisaIdAdvisory":[]}