A broken access control flaw in the fleetdm Fleet application allows any authenticated user, including those with the lowest Observer role, to reach the debug and pprof endpoints. This can expose internal server diagnostics, runtime profiling data, and in‑memory application state. Because the endpoints support CPU‑heavy profiling operations, a malicious user could trigger denial of service by exhausting server resources.

Fleetdm Fleet versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 are affected. The vulnerability exists in the open‑source Fleet device management software, handling authentication but lacking role checks for the exposed endpoints.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low exploitation probability at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog. An attacker must have valid credentials and network access to the Fleet instance; the flaw is exploitable from anywhere the application is reachable. Successful exploitation enables data exposure and can lead to service degradation through repeated profiling calls.