The vulnerability is a second‑order SQL injection in Fleet’s Apple MDM profile delivery pipeline. When an attacker submits a specially crafted request using a valid MDM enrollment certificate, the payload is later interpreted as part of an SQL statement. This flaw can be used to exfiltrate or alter data stored in the Fleet database, specifically user credentials, API tokens, and device enrollment secrets.

Fleet, the open‑source device management platform from fleetdm, is affected in all releases prior to version 4.81.0. The vulnerability exists in the Apple MDM profile delivery component and is addressed by the 4.81.0 release. No other products or components are listed.

The CVSS score of 6.2 indicates medium severity, while the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting a low likelihood of current exploitation. Exploitation requires possession of a valid MDM enrollment certificate, meaning an attacker must first gain or compromise such a certificate. Once the SQL injection is triggered, the attacker can read or modify the database contents that the description mentions. No evidence of broader lateral movement or additional privileges is claimed by the CVE data.