fkie_cve-2026-41262

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team and bypass Fleet's team isolation model. The handler authorizes the request against an empty policy object whose TeamID is nil, which an authorization rule permits for any user holding a role on any team, and then fetches the policy by ID with no team filter and returns it without any post-fetch scope check. Because policy IDs are sequential integers, an attacker can enumerate them to read other teams' policy SQL queries, host pass and fail counts, and associated software-installer and script metadata, exposing security-monitoring strategies and compliance posture across team boundaries. This issue is fixed in version 4.85.0.

GHSA-gm7f-v959-fr2g — Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Affected: Go: github.com/fleetdm/fleet/v4

## Summary

The global policy read endpoint (`GET /api/latest/fleet/policies/{policy_id}`) performs authorization against an empty `fleet.Policy{}` struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a user with observer-level access on any single team to read the full details of policies belonging to any other team, bypassing Fleet's team isolation model.

## Details

The vulnerability is in `GetPolicyByIDQueries` at `server/service/global_policies.go:163-180`:

```go func (svc Service) GetPolicyByIDQueries(ctx context.Context, policyID uint) (*fleet.Policy, error) { // Auth check uses empty Policy{} — TeamID is nil if err := svc.authz.Authorize(ctx, &fleet.Policy{}, fleet.ActionRead); err != nil { return nil, err }

// Fetches ANY policy by ID, regardless of team ownership policy, err := svc.ds.Policy(ctx, policyID) if err != nil { return nil, err } // ... populates install_software and run_script, returns full policy return policy, nil } ```

The authorization passes because the OPA rule at `server/authz/policy.rego:724-728` allows reading policies with null `team_id` for any user who holds a role on any team:

```rego allow { is_null(object.team_id) object.type == "policy" team_role(subject, subject.teams[_].id) == [admin, maintainer, technician, observer, observer_plus][_] action == read } ```

Since the auth object has nil TeamID, this rule fi…

Most recent entries from all

fkie_cve-2026-41262

GHSA-gm7f-v959-fr2g — Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint