A second‑order SQL injection flaw exists in Fleet’s Apple MDM profile delivery pipeline. An attacker who can present a valid MDM enrollment certificate may trigger the flaw to read or modify database entries, including user credentials, API tokens, and device enrollment secrets, thereby exposing or tampering with sensitive data.

The vulnerability impacts the open‑source Fleet device‑management platform, FleetDM, in any release prior to 4.81.0. Users running older Fleet installations that handle Apple MDM profiles are susceptible.

The CVSS score of 6.2 indicates moderate severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires possession of a valid MDM enrollment certificate; an attacker with such credentials can leverage the injection, gaining partial control over the database. Given the moderate CVSS and the necessity of a legitimate certificate, the overall risk for organizations that comply with best practices is moderate, but the potential impact of credential theft and data tampering warrants swift action.