An authenticated user can exploit a SQL injection flaw in the fleetdm/fleet software when specifying the order_key query parameter. The vulnerable code constructs an ORDER BY clause by escaping identifiers with backticks, but a specially crafted input can break out of the quoted identifier and inject arbitrary SQL expressions. Although the attack is limited to an ORDER BY context, it allows attackers to use blind techniques that modify the order of results to infer database contents. Crafted payloads may also induce expensive computations or cause query failures, degrading service availability. The flaw does not provide evidence of reliable data modification or stacked query execution but can still lead to confidential data leakage and potential denial of service.

The affected product is Fleet, the open‑source device management platform, versions prior to 4.80.1. Version 4.80.1 contains a fix that closes the vulnerability.

The CVSS score of 5.1 reflects a moderate risk, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attack requires authentication to a user with access to the endpoint that accepts the order_key parameter. The main impact is the potential for data disclosure via blind SQL injection, with a secondary risk of service degradation through excessive query processing.