A classic parameter manipulation flaw in the MDM bootstrap configuration exposed by the Fleet open‑source device management platform allows authenticated users with Team Admin or Global Admin rights to perform SQL injection attacks. An attacker can read or modify arbitrary database records, exfiltrate sensitive data, and inject invalid or malicious configuration entries into team settings. This directly compromises data confidentiality and integrity, enabling unauthorized configuration changes that could affect device management policies.

The vulnerability exists in all Fleet releases prior to version 4.81.0. Users operating fleetdm:Fleet on any platform before the 4.81.0 patch are exposed. Version 4.81.0 implements the fix and should be deployed to all affected installations.

The CVSS score of 6.3 indicates a medium severity assessment, while an EPSS score of less than 1% shows a low predicted probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. However, the attack vector requires legitimate high‑privilege credentials; once in possession of Team or Global Admin rights, the SQL injection can be executed through normal API calls without additional discovery steps.