CVE-2026-103264

{
  "etk_id": "ETK-2026-241",
  "cve_id": "CVE-2026-103264",
  "display_id": "CVE-2026-103264",
  "ghsa_id": "GHSA-rmfg-c7hm-wv58",
  "euvd_id": "EUVD-2026-90658",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Fleet device API",
  "summary": "Fleet releases before 4.87.0 can treat non-secret device identifiers as valid credentials for the device API. An unauthenticated party able to obtain or guess those identifiers may impersonate an iOS or iPadOS device, access device data, and invoke device-scoped actions.",
  "mitigation": "Upgrade Fleet to version 4.87.0 or later. Until the upgrade is complete, restrict access to the device API to trusted networks and clients.",
  "vendor": "fleetdm",
  "product": "fleet",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.87.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.87.0"
      ],
      "package_name": "fleet",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0031,
  "epss_percentile": 0.2189,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 71.80736383333333,
  "t0_at": "2026-10-01T10:42:06.306000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-02T15:00:30.920790+00:00",
      "days": 1.1794515600694444,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T10:42:06.306000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-01T10:42:06.306000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T10:42:06.306000+00:00",
      "url": "https://github.com/advisories/GHSA-rmfg-c7hm-wv58"
    }
  }
}