Fleet, an open‑source device‑management platform, contained a broken authorization check in its certificate‑template deletion API. The check validated a user‑supplied team identifier but did not verify that the template IDs to be deleted actually belonged to that team. As a result, a team administrator could delete certificate templates owned by other teams within the same Fleet instance. This loss of integrity could disrupt certificate‑based workflows such as device enrollment, Wi‑Fi or VPN authentication, resulting in downtime or forced re‑enrollment for affected teams.

The vulnerability affected all Fleet installations running a version older than 4.80.1. The affected product is the Fleet application provided by fleetdm. Version 4.80.1 or later contains the fix.

The CVSS score of 1.2 reflects the low severity, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability does not provide privilege escalation or data theft; the attacker must already have team‑administrator rights and exploit the batch‑deletion endpoint. Since the attack vector is through the internal API, the risk to the broader Fleet infrastructure is limited to integrity and availability of certificate templates, and it is not listed in the CISA Known‑Exploited Vulnerabilities catalog.