Detections
Analytics

SCA: security update for github.com/fleetdm/fleet/v4 (GHSA-gm7f-v959-fr2g)

medium Tenable Self-Hosted Container Security Plugin ID 444093

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the
 global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) fails to verify team ownership of
 the requested policy, allowing an authenticated user with observer-level access on any single team to read
 the full details of policies belonging to any other team and bypass Fleet's team isolation model. The
 handler authorizes the request against an empty policy object whose TeamID is nil, which an authorization
 rule permits for any user holding a role on any team, and then fetches the policy by ID with no team
 filter and returns it without any post-fetch scope check. Because policy IDs are sequential integers, an
 attacker can enumerate them to read other teams' policy SQL queries, host pass and fail counts, and
 associated software-installer and script metadata, exposing security-monitoring strategies and compliance
 posture across team boundaries. This issue is fixed in version 4.85.0. (CVE-2026-41262)

Solution

Update the github.com/fleetdm/fleet/v4 library and its related packages to version 4.85.0 or later.

See Also

https://github.com/advisories/GHSA-gm7f-v959-fr2g

Plugin Details

Severity: Medium

ID: 444093

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/27/2026

Updated: 8/27/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2026-41262

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2026

Vulnerability Publication Date: 6/26/2026

Reference Information

CVE: CVE-2026-41262

cwe: CWE-863