deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g7fp-cqj5-x8hf
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 8.0.0[PII_REDACTED]0200-d27a2195068d, < 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b
Patched in: 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b

Summary: Mattermost has an Incorrect Authorization issue

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574
GitHub Security Advisory: GHSA-g7fp-cqj5-x8hf
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.11.0-rc1, < 10.11.1
Patched in: 10.11.11

Summary: Mattermost has an Incorrect Authorization issue

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574
GitHub Security Advisory: GHSA-g7fp-cqj5-x8hf
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost has an Incorrect Authorization issue

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574
GitHub Security Advisory: GHSA-g7fp-cqj5-x8hf
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.3.0-rc1, < 11.3.2
Patched in: 11.3.2

Summary: Mattermost has an Incorrect Authorization issue

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574
GitHub Security Advisory: GHSA-g7fp-cqj5-x8hf
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.4.0-rc1, < 11.4.1
Patched in: 11.4.1

Summary: Mattermost has an Incorrect Authorization issue

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574
GitHub Security Advisory: GHSA-rmhw-c3xr-m3xx
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 8.0.0[PII_REDACTED]0200-d27a2195068d, < 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b
Patched in: 10.11.11

Summary: Mattermost doesn't properly validate CSRF tokens

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request. Mattermost Advisory ID: MMSA-2026-00578
GitHub Security Advisory: GHSA-rmhw-c3xr-m3xx
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 10.11.0-rc1, < 10.11.1
Patched in: 10.11.11

Summary: Mattermost doesn't properly validate CSRF tokens

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request. Mattermost Advisory ID: MMSA-2026-00578
GitHub Security Advisory: GHSA-rmhw-c3xr-m3xx
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 11.2.0-rc1, < 11.2.3
Patched in: 11.2.3

Summary: Mattermost doesn't properly validate CSRF tokens

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request. Mattermost Advisory ID: MMSA-2026-00578
GitHub Security Advisory: GHSA-rmhw-c3xr-m3xx
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 11.3.0-rc1, < 11.3.2
Patched in: 11.3.2

Summary: Mattermost doesn't properly validate CSRF tokens

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request. Mattermost Advisory ID: MMSA-2026-00578
GitHub Security Advisory: GHSA-rmhw-c3xr-m3xx
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 11.4.0-rc1, < 11.4.1
Patched in: 11.4.1

Summary: Mattermost doesn't properly validate CSRF tokens

Details:
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request. Mattermost Advisory ID: MMSA-2026-00578
GitHub Security Advisory: GHSA-f8xp-wvcx-p6f4
Package: github.com/cloudreve/Cloudreve/v4 (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Vulnerable versions: < 4.0.0[PII_REDACTED]3604-ec9fdd33bc54
Patched in: 4.0.0[PII_REDACTED]3604-ec9fdd33bc54

Summary: Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

Details:
### Impact
This vulnerability affects **Cloudreve** instances that were **first deployed/initialized** with versions prior to V4.10.0.

The application uses the weak pseudo-random number generator `math/rand` seeded with `time.Now().UnixNano()` to generate critical security secrets, including the `secret_key`, and `hash_id_salt`. These secrets are generated upon first startup and persisted in the database.

An attacker can exploit this by obtaining the administrator's account creation time (via public API endpoints) to narrow the search window for the PRNG seed, and use known hashid to validate the seed. By brute-forcing the seed (demonstrated to take <3 hours on general consumer PC), an attacker can predict the `secret_key`. This allows them to forge valid JSON Web Tokens (JWTs) for any user, including administrators, leading to full account takeover and privilege escalation.

**Note**: Servers running V4.10.0+ are still vulnerable if they were originally installed using an older version, as the weak secrets persist in the configuration.

### Patches
The issue has been addressed in version 4.13.0.
This patch introduces a migration mechanism that automatically:

1. Invalidate the existing `secret_key`.
2. Regenerate a new, cryptographically secure `secret_key` using crypto/rand.

Users should upgrade to 4.13.0 immediately.

### Workarounds
If an immediate upgrade is not possible, administrators must manually rotate the critical secrets in the configuration file to invalidate potential exploits:

1. Stop the Cloudreve service.
2. In Cloudreve database, locate `secret_key` setting.
3. Replace the value with a long, random string (e.g., generated via `openssl rand -base64 64`).
4. Restart the Cloudreve service.

_Note: This will log out all currently active users._

### Resources
* Vulnerable Code (Seeding): https://github.com/cloudreve/cloudreve/blob/87d48ac4a7acbc68064c2b9cb23793ac97f4392d/pkg/util/common.go#L21C1-L23C2
* Vulnerable Code (Usage): https://github.com/cloudreve/cloudreve/blob/87d48ac4a7acbc68064c2b9cb23793ac97f4392d/inventory/setting.go#L591
* [Go Documentation (math/rand)](https://pkg.go.dev/math/rand)
GitHub Security Advisory: GHSA-fg35-5rf6-qg3g
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 8.0.0[PII_REDACTED]0200-d27a2195068d, < 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b
Patched in: 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b

Summary: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow. Mattermost Advisory ID: MMSA-2026-00590
GitHub Security Advisory: GHSA-fg35-5rf6-qg3g
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 10.11.0-rc1, < 10.11.2
Patched in: 10.11.12

Summary: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow. Mattermost Advisory ID: MMSA-2026-00590
GitHub Security Advisory: GHSA-fg35-5rf6-qg3g
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 11.2.0-rc1, < 11.2.4
Patched in: 11.2.4

Summary: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow. Mattermost Advisory ID: MMSA-2026-00590
GitHub Security Advisory: GHSA-fg35-5rf6-qg3g
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 11.3.0-rc1, < 11.3.2
Patched in: 11.3.2

Summary: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow. Mattermost Advisory ID: MMSA-2026-00590
GitHub Security Advisory: GHSA-fg35-5rf6-qg3g
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 11.4.0-rc1, < 11.4.1
Patched in: 11.4.1

Summary: Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow. Mattermost Advisory ID: MMSA-2026-00590
GitHub Security Advisory: GHSA-247x-7qw8-fp98
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 11.2.0-rc1, < 11.2.4
Patched in: 11.2.4

Summary: Mattermost doesn't rate limit login requests, allowing DoS

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566
GitHub Security Advisory: GHSA-247x-7qw8-fp98
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 11.3.0-rc1, < 11.3.2
Patched in: 11.3.2

Summary: Mattermost doesn't rate limit login requests, allowing DoS

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566
GitHub Security Advisory: GHSA-247x-7qw8-fp98
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 11.4.0-rc1, < 11.4.1
Patched in: 11.4.1

Summary: Mattermost doesn't rate limit login requests, allowing DoS

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to rate limit login requests which allows unauthenticated remote attackers to cause denial of service (server crash and restart) via HTTP/2 single packet attack with 100+ parallel login requests.. Mattermost Advisory ID: MMSA-2025-00566
GitHub Security Advisory: GHSA-86vc-mg26-fj6x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 10.11.0-rc1, < 10.11.2
Patched in: 10.11.2

Summary: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds 

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595
GitHub Security Advisory: GHSA-86vc-mg26-fj6x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 8.0.0[PII_REDACTED]0200-d27a2195068d, < 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b
Patched in: 8.0.0[PII_REDACTED]0922-b7d4a1f1f59b

Summary: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds 

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595
GitHub Security Advisory: GHSA-86vc-mg26-fj6x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 11.2.0-rc1, < 11.2.4
Patched in: 11.2.4

Summary: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds 

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595
GitHub Security Advisory: GHSA-86vc-mg26-fj6x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 11.3.0-rc1, < 11.3.2
Patched in: 11.3.2

Summary: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds 

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595
GitHub Security Advisory: GHSA-86vc-mg26-fj6x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 11.4.0-rc1, < 11.4.1
Patched in: 11.4.1

Summary: Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds 

Details:
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595
GitHub Security Advisory: GHSA-4f9r-x588-pp2h
Package: github.com/fleetdm/fleet/v4 (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 4.81.0
Patched in: 4.81.0

Summary: Fleet's user account creation via invite does not enforce invited email address

Details:
### Summary

Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin.

### Impact

If an attacker gains access to a valid invite token, they can create a Fleet user account with an email address of their choosing while inheriting the invite’s assigned role and team memberships.

This issue:

- Requires possession of a valid invite token
- Does not bypass authentication controls beyond invite-based account creation
- Does not expose data without successful account creation

### Workarounds

If upgrading immediately is not possible:

- Treat invite links as sensitive credentials and avoid sharing them in public or semi-public channels (e.g., Slack, Teams).
- Revoke and reissue invites if there is any concern that an invite link may have been exposed.
- Prefer issuing invites with the minimum required privileges and elevating roles after account creation when appropriate.

### For more information

If there are any questions or comments about this advisory:

Send an email to [security@fleetdm.com](mailto:security@fleetdm.com)

### Credits

Fleet thanks @fuzzztf for responsibly reporting this issue.
GitHub Security Advisory: GHSA-w254-4hp5-7cvv
Package: github.com/fleetdm/fleet/v4 (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-703: Improper Check or Handling of Exceptional Conditions
Vulnerable versions: < 4.81.0
Patched in: 4.81.0

Summary: Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Details:
### Summary

A Denial of Service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers.

### Impact

An attacker with access to a valid Launcher node key can send a specially crafted gRPC request to the Fleet server that triggers an unrecoverable server crash. The gRPC server lacks appropriate error recovery handling, meaning the entire Fleet process terminates rather than gracefully rejecting the malformed input.

Because the crash is instant and repeatable, an attacker could script repeated requests to prevent the server from recovering, resulting in a persistent denial of service until a patched version is deployed.

### Workarounds

There is no workaround for this issue other than upgrading to a patched version.

### For more information

If there are any questions or comments about this advisory:

Send an email to  [security@fleetdm.com](mailto:security@fleetdm.com)

Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

Fleet thanks @fuzzztf for responsibly reporting this issue.
GitHub Security Advisory: GHSA-9p23-p2m4-2r4m
Package: github.com/fleetdm/fleet/v4 (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 4.81.0
Patched in: 4.81.0

Summary: Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

Details:
### Summary

A SQL Injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs via direct API calls.

### Impact

An authenticated user with Team Admin or Global Admin role can exploit a flaw in how user-supplied input is handled during MDM bootstrap package configuration. Insufficient server-side input validation allows crafted input to manipulate database queries in unintended ways.

Successful exploitation could enable cross-team data corruption, exfiltration of sensitive information such as password hashes and API tokens, and potential privilege escalation. Exploitation requires authentication with team or global admin privileges and MDM to be enabled.

This issue does not affect instances where Apple MDM is disabled.

### Workarounds

If an immediate upgrade is not possible, affected Fleet users should temporarily disable Apple MDM or limit admin roles.

### For more information

If there are any questions or comments about this advisory:

Send an email to  [security@fleetdm.com](mailto:security@fleetdm.com)

Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

### Credits

Fleet thanks the Secfox Research Team (@secfox-ai) for responsibly reporting this issue.