The vulnerability resides in Fleet’s configuration API, which returns Google Calendar service account credentials without proper obfuscation. Users authenticated with the lowest‑privileged “Observer” role can retrieve the private key material. This permits an attacker to access Google Calendar data or other Workspace resources tied to the service account, though it does not allow privilege escalation within Fleet itself. The weakness is categorised as CWE‑201, improper control of sensitive data exposure.

Any installation of Fleet open‑source device management software using Google Calendar integration in versions prior to 4.80.1 is affected. The API endpoint that returns configuration data is accessible to authenticated users with the Observer role. The CVE applies to the fleetdm:fleet product family, as indicated by the CNA and CPE entries.

With a CVSS score of 1.3, the severity is considered low; an EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be via an authenticated API call to a configuration endpoint. Although the impact does not include Fleet privilege escalation, the exposure of service account credentials represents a significant risk to the external Google Workspace environment. Overall, the risk is low but warrants mitigation due to credential leakage.