Fleet before 4.89.0 contains an SQL injection flaw in the activity listing endpoints. An authenticated user who can view activity logs can supply an arbitrary order key in the ORDER BY clause, which the deprecated cursor‑paginaton helper inserts directly into the SQL statement. The injection cannot alter data or raise privileges, but it allows the sort order to be manipulated by columns that are not normally exposed, revealing sensitive fields such as the 'details' column of activity_past entries. The consequence is read‑only information disclosure limited to activity audit data.

The vulnerability affects the Fleet product developed by FleetDM. All releases prior to version 4.89.0 are susceptible, as the patch removes the unsafe helper and introduces proper column sanitization. The affected endpoints are GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities.

The CVSS score of 2.3 indicates a low severity rating, and the EPSS score is currently unavailable; therefore the likelihood of exploitation is presumed to be low. The vulnerability is not listed in the CISA KEV catalog, and exploitation requires authenticated API access with read rights to activity data, limiting the attack surface. While the injected payload does not allow write operations or privilege escalation, it can expose confidential audit information to an attacker with appropriate permissions.