Fleet versions prior to 4.87.0 expose two endpoints that serve enterprise iOS application packages and manifests without the intended random, time‑limited URL token. Because Apple’s MDM command requires these URLs to be reachable without a Fleet session, the missing token allows an unauthenticated attacker with network access to the Fleet server to download in‑house IPA binaries and their metadata—including bundle identifier, version, and name—by guessing sequential identifiers. The flaw is a CWE‑862 “Missing Authorization” weakness; it provides no privilege escalation or write capabilities, limiting the impact to information disclosure.

The vendor is FleetDM and the product is Fleet. All Fleet installations using the enterprise tier before the 4.87.0 release are affected. The free tier is unaffected, as it returns an error due to a missing license. The vulnerability is mitigated in Fleet version 4.87.0 and later where the URL token is properly generated and enforced.

The CVSS score for this flaw is 6.9, indicating moderately high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have network connectivity to the Fleet server – a condition this description orients to, though the exact vector is not explicitly stated – and can exploit the flaw by repeatedly attempting sequential title identifiers until an app package or manifest is retrieved. No additional privileges are required beyond network access, and the attack would result solely in disclosure of application binaries and associated metadata.