The vulnerability allows authenticated users with Observer, Observer+, or Technician roles—whether global or team‑scoped—to retrieve unmasked team enroll secrets and detailed agent configuration from the target search endpoint. These secrets enable attackers to add unauthorized hosts to the affected team, and exposed agent options may contain embedded credentials such as AWS access keys or proxy passwords. The flaw is a privacy violation, classified as CWE‑200, resulting in the loss of confidentiality for all team‑level data accessible through this endpoint.

The flaw impacts the open‑source Fleet device management platform from fleetdm. All installations running a version earlier than 4.87.0 are susceptible; the vulnerability was addressed in version 4.87.0 and later releases.

The CVSS score of 6.5 indicates a moderate risk, and the EPSS data is not available. The vulnerability is not listed in CISA’s KEV catalog, but the presence of a workable exploit path—an authenticated HTTP POST to /api/latest/fleet/targets by an observer‑privileged user—means that the exploitation probability is realistic for environments where observer roles exist and are widely assigned. An attacker who gains a legitimate observer account can recover secrets without needing higher privileges, making the threat significant in shared or multi‑tenant deployments.